URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Submission: On May 24 via automatic, source openphish — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 52.32.227.155, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is sitemah218.roconpaas.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on April 11th 2023. Valid for: a year.
This is the only time sitemah218.roconpaas.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 52.32.227.155 16509 (AMAZON-02)
6 2001:7c0:2041... 553 (BELWUE Be...)
2 129.69.192.115 553 (BELWUE Be...)
1 2001:7c0:2041... 553 (BELWUE Be...)
11 5
Domain Requested by
8 mail.uni-stuttgart.de sitemah218.roconpaas.com
mail.uni-stuttgart.de
1 assets.mail.uni-stuttgart.de mail.uni-stuttgart.de
1 sitemah218.roconpaas.com
11 3

This site contains links to these domains. Also see Links.

Domain
www.tik.uni-stuttgart.de
Subject Issuer Validity Valid
*.roconpaas.com
Amazon RSA 2048 M01
2023-04-11 -
2024-05-09
a year crt.sh
lbvs.tik.uni-stuttgart.de
DFN-Verein Global Issuing CA
2022-09-01 -
2023-10-02
a year crt.sh
assets.mail.uni-stuttgart.de
Sectigo RSA Organization Validation Secure Server CA
2023-03-08 -
2024-03-07
a year crt.sh

This page contains 1 frames:

Primary Page: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Frame ID: AA653B880D16355AF8049999816262D3
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

UniMail Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

91 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

5
IPs

2
Countries

265 kB
Transfer

265 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.htm
sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/
4 KB
2 KB
Document
General
Full URL
https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.32.227.155 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-227-155.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b00474bf48f481688d182f620a3c97eceafb96922843d980b681e80bb350eb65

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=604800 public
content-encoding
gzip
content-type
text/html
date
Wed, 24 May 2023 17:12:28 GMT
etag
W/"646c8301-118a"
expires
Wed, 31 May 2023 17:12:28 GMT
last-modified
Tue, 23 May 2023 09:10:25 GMT
server
nginx
vary
Accept-Encoding
lm_auth_proxy
mail.uni-stuttgart.de/
111 KB
112 KB
Stylesheet
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=bootstrap.min.css
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::1b1b Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
/
Resource Hash
96b126417447a9c5d415f06e00e2e6372248c9857f5ff60b6477f8c6f55c449a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
114011
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
text/css
lm_auth_proxy
mail.uni-stuttgart.de/
382 B
598 B
Stylesheet
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=login.css
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::1b1b Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
/
Resource Hash
4ded0597e42cc2c4c0f836f1d1179f8cd2add55aebdfc2a90604e2c1c27c0c2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
382
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
text/css
lm_auth_proxy
mail.uni-stuttgart.de/
91 KB
91 KB
Script
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=jquery-1.10.2.min.js
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::1b1b Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
/
Resource Hash
c73b004ebf31b395cf237c3d2b13c1e576f385e04660ceb5f7be163ff3c201dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
93064
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
text/javascript
lm_auth_proxy
mail.uni-stuttgart.de/
34 KB
34 KB
Script
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=bootstrap.min.js
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::1b1b Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
/
Resource Hash
484081bfe6c76d77610eb71a6e71206fe5304d62c037f058b403592192069306
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
34653
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
text/javascript
lm_auth_proxy
mail.uni-stuttgart.de/
2 KB
2 KB
Script
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=lm_sso.js
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
129.69.192.115 , Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
lbvs.tik.uni-stuttgart.de
Software
/
Resource Hash
c2760654e783dfb10fcb45ab5ba2e1307085f3c0d80b563532ee08fdc03a1987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
2138
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
text/javascript
lm_auth_proxy
mail.uni-stuttgart.de/
538 B
754 B
Stylesheet
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=font.css
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::1b1b Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
/
Resource Hash
dae4c527bae7c60f1bc98385143a415cce78b13610831aa327ff7d00764d18ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
538
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
text/css
lm_auth_proxy
mail.uni-stuttgart.de/
15 KB
15 KB
Image
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=unilogo-beschriftet.png
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
129.69.192.115 , Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
lbvs.tik.uni-stuttgart.de
Software
/
Resource Hash
3429dc04623e5637dc501a39e60ee7fd20dacf53ec8c0c9d46196482f52efbf2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
15210
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
image/png
lm_auth_proxy
mail.uni-stuttgart.de/
7 KB
7 KB
Image
General
Full URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=owa-logo.png
Requested by
Host: sitemah218.roconpaas.com
URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::1b1b Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
/
Resource Hash
819b7b37ba36488937beea45b9668314cd18bc2fcb090adef6a0a384ebead0b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:28 GMT
X-Content-Type-Options
nosniff
Connection
close
Content-Length
6937
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Type
image/png
owa-login.js
assets.mail.uni-stuttgart.de/
66 B
385 B
Script
General
Full URL
https://assets.mail.uni-stuttgart.de/owa-login.js
Requested by
Host: mail.uni-stuttgart.de
URL: https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=lm_sso.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2001:7c0:2041:218::113 Stuttgart, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
Software
Apache /
Resource Hash
0463c6044ae4c3b9b4e3a764000fab939727408c42c5d0eb02d84fdb5bedd1da
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date
Wed, 24 May 2023 17:12:29 GMT
Strict-Transport-Security
max-age=31556926
Via
1.1 assets.mail.uni-stuttgart.de
Server
Apache
etag
"0463c6044ae4c3b9b4e3a764000fab939727408c"
content-type
application/javascript
Connection
Keep-Alive
Keep-Alive
timeout=15, max=100
content-length
66
lm_auth_proxy
mail.uni-stuttgart.de/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mail.uni-stuttgart.de
URL
https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=raleway_medium_2.woff2

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery object| jQuery110205791806417007763 string| xx_msg10 string| xx_msg11 string| xx_msg15 string| xx_msg17 function| errmsg function| save_username function| getCookie function| loadvalues function| sso_setup function| handle_ourlogin

2 Cookies

Domain/Path Name / Value
sitemah218.roconpaas.com/ Name: AWSALB
Value: 0dopKVkf5dV/XoxDEab+Hek7v+4AJEJGAfP061+gIey3t9dDK5oVXdc7t9RUc1gSrZYhJ1Zgrvjx96RCbX6+V8WBEwAZvpYvkM9sQB+ROmVY2znFIOCXfGMgZ1lq
sitemah218.roconpaas.com/ Name: AWSALBCORS
Value: 0dopKVkf5dV/XoxDEab+Hek7v+4AJEJGAfP061+gIey3t9dDK5oVXdc7t9RUc1gSrZYhJ1Zgrvjx96RCbX6+V8WBEwAZvpYvkM9sQB+ROmVY2znFIOCXfGMgZ1lq

2 Console Messages

Source Level URL
Text
javascript error URL: https://sitemah218.roconpaas.com/wp-content/themes/twentytwentytwo/styles/index.htm
Message:
Access to font at 'https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=raleway_medium_2.woff2' from origin 'https://sitemah218.roconpaas.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://mail.uni-stuttgart.de/lm_auth_proxy?LMimage=raleway_medium_2.woff2
Message:
Failed to load resource: net::ERR_FAILED