themenkreuzfahrten.net Open in urlscan Pro
2001:8d8:100f:f000::22e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://themenkreuzfahrten.net/staticpage_images/whats-app/780db/vbv2.php
Effective URL:
http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php
Submission: On October 30 via automatic, source openphish (October 30th 2020, 1:29:08 pm UTC)

Summary HTTP 22 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 22 HTTP transactions. The main IP is 2001:8d8:100f:f000::22e, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is themenkreuzfahrten.net.

This is the only time themenkreuzfahrten.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1 21	2001:8d8:100f... 2001:8d8:100f:f000::22e	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
1	151.101.14.2 151.101.14.2	54113 (FASTLY) (FASTLY)
1	2a02:8400:21:... 2a02:8400:21:1::3	15557 (LDCOMNET) (LDCOMNET)
22	3

21 2001:8d8:100f:f000::22e (Germany) 1 redirects

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)

themenkreuzfahrten.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

image.jimcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:8400:21:1::3 (France)

ASN15557 (LDCOMNET, FR)

static.s-sfr.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	themenkreuzfahrten.net 1 redirects themenkreuzfahrten.net	201 KB
1	s-sfr.fr static.s-sfr.fr
1	jimcdn.com image.jimcdn.com	43 KB
22	3

	Domain	Requested by
21	themenkreuzfahrten.net	1 redirects themenkreuzfahrten.net
1	static.s-sfr.fr	themenkreuzfahrten.net
1	image.jimcdn.com	themenkreuzfahrten.net
22	3

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
plus.google.com
blog.whatsapp.com

Subject Issuer	Validity	Valid
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-14` - `2021-04-23`	6 months	crt.sh
*.s-sfr.fr Certigna Wild CA	`2020-05-11` - `2022-05-11`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php
Frame ID: 298C116408DE0280781694CBD07A1BEE
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://themenkreuzfahrten.net/staticpage_images/whats-app/780db/vbv2.php HTTP 301
http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

22
Requests

9 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

244 kB
Transfer

244 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/whatsapp
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WhatsApp
Title: Facebook

Search URL Search Domain Scan URL

URL: https://plus.google.com/102708307632999019941/posts
Title: Google Plus

Search URL Search Domain Scan URL

URL: http://blog.whatsapp.com/245/
Title: Why not sell ads

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://themenkreuzfahrten.net/staticpage_images/whats-app/780db/vbv2.php HTTP 301
http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request vbv2.php Show response themenkreuzfahrten.net/staticpage_images/Whats-App/780db/ Redirect Chain http://themenkreuzfahrten.net/staticpage_images/whats-app/780db/vbv2.php http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php	8 KB 3 KB	66ms 65ms	Document text/html	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / PHP/5.6.40 Resource Hash `b5d49905f87a314325ff151147877eb1c934e0451379528945ce7163d85c612b` Request headers Host themenkreuzfahrten.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=15 Date Fri, 30 Oct 2020 13:28:52 GMT Server Apache X-Powered-By PHP/5.6.40 Content-Encoding gzip Redirect headers Content-Type text/html; charset=iso-8859-1 Content-Length 280 Connection keep-alive Keep-Alive timeout=15 Date Fri, 30 Oct 2020 13:28:52 GMT Server Apache Location http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php
GET H/1.1	200 OK	style_m_common.css themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/	31 KB 31 KB	19ms 17ms	Stylesheet text/css	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_common.css?1 Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `08fa0d9f0e97daf977015f8e5bbfc74c691ca8cb2a5ec501a3b9331c31b8eec6` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "7abe-5a06ed1245f43" Content-Type text/css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 31422
GET H/1.1	200 OK	style_m_other.css themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/	5 KB 6 KB	31ms 20ms	Stylesheet text/css	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `8a3bdf800333af7d9ef2dadc033e14366b3e6896e765d03d86191042313b5c6a` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "152f-5a06ed1245f43" Content-Type text/css Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 5423
GET H/1.1	200 OK	jquery.js Show response themenkreuzfahrten.net/staticpage_images/Whats-App/780db/js/	93 KB 93 KB	29ms 18ms	Script application/javascript	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/js/jquery.js Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "17277-5a06ed12614c6" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 94839
GET H/1.1	200 OK	load.gif themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	34 KB 35 KB	27ms 17ms	Image image/gif	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/load.gif Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `1c57a6c39d04572b0f431e4ef01e6029a180b070d3efebaee26e27c82e384f12` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "898c-5a06ed12568e4" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 35212
GET H2	200	image.png image.jimcdn.com/app/cms/image/transf/none/path/sf3cb303cb608181e/image/i9bb3d925762d377a/version/1446631151/	43 KB 43 KB	87ms 29ms	Image image/png	151.101.14.2 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://image.jimcdn.com/app/cms/image/transf/none/path/sf3cb303cb608181e/image/i9bb3d925762d377a/version/1446631151/image.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash `4e6184f8722d4b451021d2d0739b14359182feabb5c8dfc54da8b8a0752bedb4` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id Rz7Oh876ST9rrShGdh2ZjHaO._Ne0epb via 1.1 varnish, 1.1 varnish etag "e2fccb9d91a395606237668beab01a51" fastly-restarts 1 age 173874 x-cache HIT, HIT status 200 content-disposition inline; filename=UTF-8''1446631151.png x-amz-request-id* 4469423D86A17081 x-amz-id-2 FhrWSVroPtC2sYeuvWW3AW4GHQjGN9MhLchwavJWrkiA87YT9m6D32UdAW/rCJ2/RraRgXuo7lM= x-served-by cache-lcy19238-LCY, cache-fra19166-FRA accept-ranges bytes last-modified Wed, 04 Nov 2015 09:59:10 GMT server AmazonS3 x-timer S1604064532.349259,VS0,VE1 date Fri, 30 Oct 2020 13:28:52 GMT content-type image/png access-control-allow-origin * expires Fri, 23 Oct 2020 23:44:01 GMT fastly-debug-digest be36521adc0f9128edfc331dfeedcc6356ce8f345fc7d74cb7e1ba8e2f51797c content-length 43647 x-cache-hits 1, 1
GET H2	404	about:blank static.s-sfr.fr/media/	0 0	97ms 53ms	Script text/plain	2a02:8400:21:1::3 LDCOMNET
General Check archive.org Show headers Download Go to Full URL https://static.s-sfr.fr/media/about:blank Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:8400:21:1::3 , France, ASN15557 (LDCOMNET, FR), Reverse DNS Software nginx/1.10.3 / Resource Hash Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 30 Oct 2020 13:28:52 GMT via 1.0 static.s-sfr.fr, 1.1 lyo2-ncdn-middle-http00, 1.1 abv1-ncdn-edge-http01 sfrvia sa15859adm\|1580\|vs_SFR-FR-GP-http last-modified Fri, 30 Oct 2020 13:28:52 GMT server nginx/1.10.3 age 0 status 404 access-control-allow-methods GET, OPTIONS, HEAD, PUT, POST x-varnish 1061194546, 15052509 access-control-allow-origin * cache-control max-age=60, public content-length 0 retry-after 60 expires Fri, 30 Oct 2020 13:29:52 GMT
GET H/1.1	200 OK	payform.min.js Show response themenkreuzfahrten.net/staticpage_images/Whats-App/780db/js/	8 KB 8 KB	28ms 17ms	Script application/javascript	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/js/payform.min.js Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `835dd2920688dc082e49cb7c8a3b269664c000a4d2a7382e0a6613c19b68cac9` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "209f-5a06ed12614c6" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 8351
GET H/1.1	200 OK	bg-bar-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	5 KB 5 KB	30ms 28ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/bg-bar-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `ff960e7e798622692a8771ac1c927a36a2f3fa229f63a59e169097476a2301d0` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "14e4-5a06ed1246ee3" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 5348
GET H/1.1	200 OK	divider-bar.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	1 KB 2 KB	16ms 14ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/divider-bar.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `9d117ba3e4ca1990a770ca8a5461d580bbecf5307b794585a553a27689d2b57d` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "57e-5a06ed12568e4" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 1406
GET H/1.1	200 OK	logo-whatsapp.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	746 B 1007 B	33ms 31ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/logo-whatsapp.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `3bd648e7a39712f82c19bf61800ba05063c918594247b7ce70a58a12646ff327` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "2ea-5a06ed12568e4" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 746
GET H/1.1	200 OK	btn-nav-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	447 B 708 B	21ms 19ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-nav-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `640d6b8ba4a367d6a1955c829aee55ddf07a57bfdb40f91fd35bead5e01acf5b` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "1bf-5a06ed124bd03" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 447
GET H/1.1	200 OK	btn-twitter-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	603 B 864 B	20ms 19ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-twitter-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `8384e3b6bfe27644879f1a902fbe10f4cef6b3ec0205c116dce2a36efb25a6fe` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "25b-5a06ed124dc44" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 603
GET H/1.1	200 OK	btn-facebook-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	308 B 569 B	29ms 18ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-facebook-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `d9394504fad465010dd5540ce277daf7c8ea9f452ef68778a6f0df7b83094d25` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "134-5a06ed1247e83" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 308
GET H/1.1	200 OK	btn-googleplus-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	426 B 687 B	15ms 14ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-googleplus-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `e9d8b14c571f1bbe794612d3359fac65c274a56747cbb622abfbec65087a33fa` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "1aa-5a06ed124ad63" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 426
GET H/1.1	200 OK	icon-lang-switch-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	674 B 935 B	16ms 16ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/icon-lang-switch-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `303924861f04250b0042fc44fb8c6e2dd8c57494d9cacd124519809f0f61fea1` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "2a2-5a06ed12568e4" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 674
GET H/1.1	200 OK	vbv.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	8 KB 9 KB	16ms 14ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/vbv.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `56133cfade79f0d7053cd3f433843f8c881e6c5bdbec8c931b537a561b37bd3d` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/vbv2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "2155-5a06ed12597c5" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 8533
GET H/1.1	200 OK	bg-footer.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	1 KB 2 KB	15ms 13ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/bg-footer.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `94ad22c40a8d5fcc69d20a15a59ab21daad75f9ec1ec9d4ebd60eb9aaef17287` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "5dd-5a06ed1247e83" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 1501
GET H/1.1	200 OK	icon-lang-switch-btm-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	505 B 766 B	16ms 14ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/icon-lang-switch-btm-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `811b8714c992afded62b2a36e97ab8241a777c9d3d34aaa1b95ac91ddc315a9a` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "1f9-5a06ed12568e4" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 505
GET H/1.1	200 OK	btn-footer-twitter-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	549 B 810 B	15ms 14ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-footer-twitter-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `aed8ad8a5f7d48b09d4591c6f0db66048f2be45f6a8d474f14c4fbbe7262fd84` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "225-5a06ed1247e83" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 549
GET H/1.1	200 OK	btn-footer-facebook-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	261 B 522 B	17ms 17ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-footer-facebook-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `6c2958ca1bc73c75b0536f532f240e8b1402c1f02f5db2ccbe3154d88c96a1a3` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "105-5a06ed1247e83" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 261
GET H/1.1	200 OK	btn-footer-googleplus-lq.png themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/	519 B 780 B	14ms 13ms	Image image/png	2001:8d8:100f:f000::22e ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/images/btn-footer-googleplus-lq.png Requested by Host: themenkreuzfahrten.net URL: http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 Protocol HTTP/1.1 Server 2001:8d8:100f:f000::22e , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `e36a874f10b42ac1cec0f7b9cd2d6bd4ecaf99ddf60598eee14a899d224927ac` Request headers Referer http://themenkreuzfahrten.net/staticpage_images/Whats-App/780db/css/style_m_other.css?11 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 30 Oct 2020 13:28:52 GMT Last-Modified Mon, 09 Mar 2020 16:51:39 GMT Server Apache ETag "207-5a06ed1247e83" Content-Type image/png Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 519

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

image.jimcdn.com
static.s-sfr.fr
themenkreuzfahrten.net
151.101.14.2
2001:8d8:100f:f000::22e
2a02:8400:21:1::3
08fa0d9f0e97daf977015f8e5bbfc74c691ca8cb2a5ec501a3b9331c31b8eec6
0fb170f24675c84f8228ad6b61d69bf6705030949cc2fec316b3a006eab282f8
1c57a6c39d04572b0f431e4ef01e6029a180b070d3efebaee26e27c82e384f12
303924861f04250b0042fc44fb8c6e2dd8c57494d9cacd124519809f0f61fea1
3bd648e7a39712f82c19bf61800ba05063c918594247b7ce70a58a12646ff327
4e6184f8722d4b451021d2d0739b14359182feabb5c8dfc54da8b8a0752bedb4
56133cfade79f0d7053cd3f433843f8c881e6c5bdbec8c931b537a561b37bd3d
640d6b8ba4a367d6a1955c829aee55ddf07a57bfdb40f91fd35bead5e01acf5b
6c2958ca1bc73c75b0536f532f240e8b1402c1f02f5db2ccbe3154d88c96a1a3
811b8714c992afded62b2a36e97ab8241a777c9d3d34aaa1b95ac91ddc315a9a
835dd2920688dc082e49cb7c8a3b269664c000a4d2a7382e0a6613c19b68cac9
8384e3b6bfe27644879f1a902fbe10f4cef6b3ec0205c116dce2a36efb25a6fe
8a3bdf800333af7d9ef2dadc033e14366b3e6896e765d03d86191042313b5c6a
94ad22c40a8d5fcc69d20a15a59ab21daad75f9ec1ec9d4ebd60eb9aaef17287
9d117ba3e4ca1990a770ca8a5461d580bbecf5307b794585a553a27689d2b57d
aed8ad8a5f7d48b09d4591c6f0db66048f2be45f6a8d474f14c4fbbe7262fd84
b5d49905f87a314325ff151147877eb1c934e0451379528945ce7163d85c612b
d9394504fad465010dd5540ce277daf7c8ea9f452ef68778a6f0df7b83094d25
e36a874f10b42ac1cec0f7b9cd2d6bd4ecaf99ddf60598eee14a899d224927ac
e9d8b14c571f1bbe794612d3359fac65c274a56747cbb622abfbec65087a33fa
ff960e7e798622692a8771ac1c927a36a2f3fa229f63a59e169097476a2301d0

themenkreuzfahrten.net Open in urlscan Pro 2001:8d8:100f:f000::22e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

9 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

244 kBTransfer

244 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

themenkreuzfahrten.net Open in urlscan Pro
2001:8d8:100f:f000::22e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

9 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

244 kB
Transfer

244 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!