consent.net-secu.net Open in urlscan Pro
52.29.40.177 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5
Submission: On November 04 via api (November 4th 2024, 8:34:29 am UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 52.29.40.177, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is consent.net-secu.net.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 30th 2024. Valid for: a year.

This is the only time consent.net-secu.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
11	52.29.40.177 52.29.40.177	16509 (AMAZON-02) (AMAZON-02)
3	3.122.217.248 3.122.217.248	16509 (AMAZON-02) (AMAZON-02)
1	3.66.113.158 3.66.113.158	16509 (AMAZON-02) (AMAZON-02)
15	3

11 52.29.40.177 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

consent.net-secu.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.122.217.248 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-217-248.eu-central-1.compute.amazonaws.com

api.sosafe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.66.113.158 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-113-158.eu-central-1.compute.amazonaws.com

sentry.sosafe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	net-secu.net consent.net-secu.net	1 MB
4	sosafe.de api.sosafe.de — Cisco Umbrella Rank: 293631 sentry.sosafe.de — Cisco Umbrella Rank: 400754	22 KB
15	2

	Domain	Requested by
11	consent.net-secu.net	consent.net-secu.net
3	api.sosafe.de	consent.net-secu.net
1	sentry.sosafe.de	consent.net-secu.net
15	3

This site contains no links.

Subject Issuer	Validity	Valid
no-repiy.com Amazon RSA 2048 M02	`2024-01-30` - `2025-02-28`	a year	crt.sh
*.sosafe.de Amazon RSA 2048 M03	`2024-02-25` - `2025-03-26`	a year	crt.sh
sentry.sosafe.de Amazon RSA 2048 M03	`2024-04-10` - `2025-05-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5
Frame ID: 8F28B66F23AC49B19C14BD5C9A6D97E3
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

[Datenzugriff] Berechtigungen erforderlich

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

1340 kB
Transfer

1335 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
consent.net-secu.net/de/ 16 KB
16 KB 110ms
51ms Document
text/html 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

a2641dca280476c066f88981937b92475c40347f730a5576a7620c8e2fe19666

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-length: 15975
content-type: text/html
date: Mon, 04 Nov 2024 08:34:24 GMT
etag: "6671610f-3e67"
last-modified: Tue, 18 Jun 2024 10:27:27 GMT
referrer-policy: strict-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff

GET
H2 200 bootstrap.min.css
consent.net-secu.net/assets/bootstrap/css/ 138 KB
138 KB 27ms
25ms Stylesheet
text/css 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/assets/bootstrap/css/bootstrap.min.css?ver=1718706437593

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-22646"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 140870
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 styles.css
consent.net-secu.net/assets/css/ 4 KB
4 KB 53ms
52ms Stylesheet
text/css 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/assets/css/styles.css?ver=1718706437593

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

450448a68a3cf887e041265d35967873303ad5a523a8c3ff4ca0f72b7ce625f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-10fd"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 4349
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 accordeon.css
consent.net-secu.net/assets/css/ 2 KB
2 KB 52ms
51ms Stylesheet
text/css 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/assets/css/accordeon.css?ver=1718706437593

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ddc5e1be2ce4cbf73e14a28d4fac51e0ca164807c9aaef8eb0a7fe2116393d8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-61a"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 1562
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 info.svg
consent.net-secu.net/assets/img/ 338 B
580 B 52ms
52ms Image
image/svg+xml 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.net-secu.net/assets/img/info.svg

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e78098c9d55fcd196acc23bb905e94881fbe157504e9c179f23ae85399e28682

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-152"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 338
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: image/svg+xml
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 version.js Show response
consent.net-secu.net/assets/js/ 80 B
326 B 52ms
51ms Script
application/javascript 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/assets/js/version.js?ver=1718706437593

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ca5f74dac1a1b2794db43e57147ab60a7ee4a1f59bd544550b5f471ef64043c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-50"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 80
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: application/javascript
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 jquery.min.js Show response
consent.net-secu.net/assets/js/ 87 KB
88 KB 57ms
56ms Script
application/javascript 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/assets/js/jquery.min.js

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-15d9d"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 89501
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: application/javascript
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 bundle.min.js Show response
consent.net-secu.net/assets/js/ 426 KB
426 KB 56ms
56ms Script
application/javascript 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/assets/js/bundle.min.js?ver=1718706437593

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

498a74ce7e47a36a0ed25ddf17c894e0df4ee3dc8c8cec74050a21d985efaea6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-6a629"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 435753
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: application/javascript
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 arrow-down.png
consent.net-secu.net/assets/img/ 513 B
751 B 29ms
27ms Image
image/png 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.net-secu.net/assets/img/arrow-down.png

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/assets/css/accordeon.css?ver=1718706437593

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

926fff14fcc67d193f067f37cdff6788f32a0894c18ff0360dd090c28e908b09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-201"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 513
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: image/png
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

GET
H2 200 ip Show response
api.sosafe.de/v1/user/ 77 B
464 B 221ms
28ms XHR
application/json 3.122.217.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/user/ip

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/assets/js/bundle.min.js?ver=1718706437593

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.122.217.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-217-248.eu-central-1.compute.amazonaws.com

Software

Resource Hash

1d9ce8ceb749574245345f3eb350cdbc57803f5b44afbb8ec558c916dfd7f5b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
etag: W/"4d-KMJLIQ++GweTUTbPwhru7/HkND0"
expect-ct: max-age=0
x-permitted-cross-domain-policies: none
access-control-allow-credentials: true
x-content-type-options: nosniff
x-download-options: noopen
referrer-policy: no-referrer
access-control-allow-origin: *
content-length: 77
date: Mon, 04 Nov 2024 08:34:24 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN

GET
H2 204 favicon.ico
consent.net-secu.net/ 0
139 B 28ms
28ms Other
text/plain 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.net-secu.net/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

referrer-policy: strict-origin
strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 04 Nov 2024 08:34:24 GMT
server: nginx
x-content-type-options: nosniff

POST
H2 200 / Show response
sentry.sosafe.de/api/25/envelope/ 2 B
196 B 104ms
33ms Fetch
application/json 3.66.113.158
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sentry.sosafe.de/api/25/envelope/?sentry_key=f4fcbdbd596c4b2cb672b939a7ee93c6&sentry_version=7
Requested by: Host: consent.net-secu.net
URL: https://consent.net-secu.net/assets/js/bundle.min.js?ver=1718706437593
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.113.158 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-113-158.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://consent.net-secu.net/

Response headers

access-control-allow-origin: https://consent.net-secu.net
access-control-expose-headers: x-sentry-error, x-sentry-rate-limits, retry-after
content-length: 2
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: application/json
vary: Origin
server: nginx

GET
H2 200 info Show response
api.sosafe.de/v1/report/ 759 B
1 KB 45ms
44ms XHR
application/json 3.122.217.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/report/info?code=7a050b174602c741f1874a3081c9a1a5

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/assets/js/bundle.min.js?ver=1718706437593

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.122.217.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-217-248.eu-central-1.compute.amazonaws.com

Software

Resource Hash

b1860c02e260facdbbc41cfaee2499dee86e7f09f9dcccfcf0a6175989312faf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
etag: W/"2f7-J9ZuLfad8yqCyjzwo+P83wqIwOk"
expect-ct: max-age=0
x-permitted-cross-domain-policies: none
access-control-allow-credentials: true
x-content-type-options: nosniff
x-download-options: noopen
referrer-policy: no-referrer
access-control-allow-origin: *
content-length: 759
date: Mon, 04 Nov 2024 08:34:24 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN

GET
H2 200 report Show response
api.sosafe.de/v1/ 20 KB
20 KB 137ms
137ms XHR
application/json 3.122.217.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/report?code=7a050b174602c741f1874a3081c9a1a5&type=2

Requested by

Host: consent.net-secu.net
URL: https://consent.net-secu.net/assets/js/bundle.min.js?ver=1718706437593

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.122.217.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-217-248.eu-central-1.compute.amazonaws.com

Software

Resource Hash

59703c3cb6f27e66ec489270787d37c15d25b179438524076b7508608a28b986

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
etag: W/"4ecc-8p6m5OfDXpKoVn09Vf9bCE/kHcE"
expect-ct: max-age=0
x-permitted-cross-domain-policies: none
access-control-allow-credentials: true
x-content-type-options: nosniff
x-download-options: noopen
referrer-policy: no-referrer
access-control-allow-origin: *
content-length: 20172
date: Mon, 04 Nov 2024 08:34:25 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN

GET
H2 200 1.png
consent.net-secu.net/assets/img/ 642 KB
643 KB 34ms
33ms Image
image/png 52.29.40.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.net-secu.net/assets/img/1.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.29.40.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-40-177.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

81c4f50096d17e8cdfe9c95d5996af25efba6d081462ddd068a1014fd7cd28d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://consent.net-secu.net/de/?code=7a050b174602c741f1874a3081c9a1a5

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "66716105-a06fb"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 657147
date: Mon, 04 Nov 2024 08:34:24 GMT
content-type: image/png
last-modified: Tue, 18 Jun 2024 10:27:17 GMT
server: nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.sosafe.de
consent.net-secu.net
sentry.sosafe.de
3.122.217.248
3.66.113.158
52.29.40.177
1d9ce8ceb749574245345f3eb350cdbc57803f5b44afbb8ec558c916dfd7f5b5
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
450448a68a3cf887e041265d35967873303ad5a523a8c3ff4ca0f72b7ce625f1
46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced
498a74ce7e47a36a0ed25ddf17c894e0df4ee3dc8c8cec74050a21d985efaea6
59703c3cb6f27e66ec489270787d37c15d25b179438524076b7508608a28b986
81c4f50096d17e8cdfe9c95d5996af25efba6d081462ddd068a1014fd7cd28d4
926fff14fcc67d193f067f37cdff6788f32a0894c18ff0360dd090c28e908b09
a2641dca280476c066f88981937b92475c40347f730a5576a7620c8e2fe19666
b1860c02e260facdbbc41cfaee2499dee86e7f09f9dcccfcf0a6175989312faf
ca5f74dac1a1b2794db43e57147ab60a7ee4a1f59bd544550b5f471ef64043c4
ddc5e1be2ce4cbf73e14a28d4fac51e0ca164807c9aaef8eb0a7fe2116393d8a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e78098c9d55fcd196acc23bb905e94881fbe157504e9c179f23ae85399e28682
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

consent.net-secu.net Open in urlscan Pro 52.29.40.177 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

1340 kBTransfer

1335 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

consent.net-secu.net Open in urlscan Pro
52.29.40.177 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

1340 kB
Transfer

1335 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!