www2.ltaxgo.net Open in urlscan Pro
203.172.40.199 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8m...
Effective URL:
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Submission: On December 01 via api (December 1st 2023, 3:20:39 pm UTC) — Scanned from CH

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 4 countries across 4 domains to perform 12 HTTP transactions. The main IP is 203.172.40.199, located in Bangkok, Thailand and belongs to CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH. The main domain is www2.ltaxgo.net.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on August 6th 2023. Valid for: a year.

This is the only time www2.ltaxgo.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 2	172.65.230.173 172.65.230.173	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	8.219.112.240 8.219.112.240	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1 11	203.172.40.199 203.172.40.199	4750 (CSLOXINFO...) (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
12	3

2 172.65.230.173 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

djwx9k04.eu1.hubspotlinksfree.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.219.112.240 (Singapore) 1 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

test.docis.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 203.172.40.199 (Bangkok, Thailand) 1 redirects

ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH)
PTR: reverse-203-172-40-199.csloxinfo.net

www2.ltaxgo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	ltaxgo.net 1 redirects www2.ltaxgo.net	2 MB
2	hubspotlinksfree.com 1 redirects djwx9k04.eu1.hubspotlinksfree.com	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	2 KB
1	docis.io 1 redirects test.docis.io	305 B
12	4

	Domain	Requested by
11	www2.ltaxgo.net	1 redirects djwx9k04.eu1.hubspotlinksfree.com www2.ltaxgo.net
2	djwx9k04.eu1.hubspotlinksfree.com	1 redirects
1	fonts.googleapis.com	www2.ltaxgo.net
1	test.docis.io	1 redirects
12	4

This site contains no links.

Subject Issuer	Validity	Valid
hubspotlinksfree.com Cloudflare Inc ECC CA-3	`2023-04-17` - `2024-04-16`	a year	crt.sh
*.ltaxgo.net RapidSSL TLS RSA CA G1	`2023-08-06` - `2024-08-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Frame ID: 56949BC4D317D777B486731AE041411D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Schweizer Post

Page URL History Show full URLs

https://djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6l... Page URL
https://djwx9k04.eu1.hubspotlinksfree.com/events/public/v1/encoded/track/tc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wL... HTTP 307
https://test.docis.io/SW/CH/?utm_medium=email&_hsmi=79468815&_hsenc=p2ANqtz--qyM1h_5d3ECbFCWu-n1Wg... HTTP 302
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/ HTTP 302
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

2026 kB
Transfer

2084 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdlK8YcfgNVyqYTk8cj5LlW4jQ_jW8p_bJyW1gTfV74BX1H5W70fl011XDNZgW8XSkDN2K076zW2dp-YT50msm1W7x6hKB1Tr01tW1_m5Pd4Rzf19W4q0tJ96KtQ1yV1GDJG93RfTtW1fwcx23rx03JW6NjcyN2FVQKqVXlN105dsgJpW7zQ-Y01yh8CMW8qvd7f78zTpSW7RDnFT77nnk3d57Mzn04 Page URL
https://djwx9k04.eu1.hubspotlinksfree.com/events/public/v1/encoded/track/tc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdlK8YcfgNVyqYTk8cj5LlW4jQ_jW8p_bJyW1gTfV74BX1H5W70fl011XDNZgW8XSkDN2K076zW2dp-YT50msm1W7x6hKB1Tr01tW1_m5Pd4Rzf19W4q0tJ96KtQ1yV1GDJG93RfTtW1fwcx23rx03JW6NjcyN2FVQKqVXlN105dsgJpW7zQ-Y01yh8CMW8qvd7f78zTpSW7RDnFT77nnk3d57Mzn04?_ud=fc6f30d0-fef5-4186-b595-3e6bf90ca550&_jss=1&_fl=8&_pl=3&_hc=4&_lg=en-US,en&_plt=iPhone&_scr=1600,1200 HTTP 307
https://test.docis.io/SW/CH/?utm_medium=email&_hsmi=79468815&_hsenc=p2ANqtz--qyM1h_5d3ECbFCWu-n1WgiKsq3HpLPXKfFV2yGr9H_rIVER8-j2daKr_t7V2m28-BmLY3icqyfH8236_BjOMHFKVhKQ&utm_content=79468815&utm_source=hs_email HTTP 302
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/ HTTP 302
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdlK8YcfgNVyqYTk8cj5LlW4jQ_jW8p_bJyW1gTfV74BX1H5W70fl011XDNZgW8XSkDN2K076zW2dp-YT50msm1W7x6hKB1...
djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/ 8 KB
3 KB 165ms
73ms Document
text/html 172.65.230.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdlK8YcfgNVyqYTk8cj5LlW4jQ_jW8p_bJyW1gTfV74BX1H5W70fl011XDNZgW8XSkDN2K076zW2dp-YT50msm1W7x6hKB1Tr01tW1_m5Pd4Rzf19W4q0tJ96KtQ1yV1GDJG93RfTtW1fwcx23rx03JW6NjcyN2FVQKqVXlN105dsgJpW7zQ-Y01yh8CMW8qvd7f78zTpSW7RDnFT77nnk3d57Mzn04

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.230.173 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-CH,de;q=0.9

Response headers

access-control-allow-credentials: false
cf-cache-status: DYNAMIC
cf-ray: 82ec508ac81d59dd-MXP
content-encoding: br
content-type: text/html;charset=utf-8
date: Fri, 01 Dec 2023 15:20:31 GMT
referrer-policy: no-referrer
server: cloudflare
vary: origin
x-content-type-options: nosniff
x-envoy-upstream-service-time: 3
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: fra04/event-tracking-td/envoy-proxy-74d5b98468-82ch9
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 6cb4476c-382a-484a-b57b-bd2bf1821179
x-request-id: 6cb4476c-382a-484a-b57b-bd2bf1821179
x-robots-tag: none

GET
H/1.1

200
OK

Primary Request sx.php Show response
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/
Redirect Chain

https://djwx9k04.eu1.hubspotlinksfree.com/events/public/v1/encoded/track/tc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdl...
https://test.docis.io/SW/CH/?utm_medium=email&_hsmi=79468815&_hsenc=p2ANqtz--qyM1h_5d3ECbFCWu-n1WgiKsq3HpLPXKfFV2yGr9H_rIVER8-j2daKr_t7V2m28-BmLY3icqyfH8236_BjOMHFKVhKQ&utm_content=79468815&utm_sou...
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/
https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php

4 KB
4 KB

452ms
452ms

Document
text/html

203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Requested by: Host: djwx9k04.eu1.hubspotlinksfree.com
URL: https://djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdlK8YcfgNVyqYTk8cj5LlW4jQ_jW8p_bJyW1gTfV74BX1H5W70fl011XDNZgW8XSkDN2K076zW2dp-YT50msm1W7x6hKB1Tr01tW1_m5Pd4Rzf19W4q0tJ96KtQ1yV1GDJG93RfTtW1fwcx23rx03JW6NjcyN2FVQKqVXlN105dsgJpW7zQ-Y01yh8CMW8qvd7f78zTpSW7RDnFT77nnk3d57Mzn04
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 / PHP/7.2.34
Resource Hash: 5694709396ac332331519d270b3989acd497b1c0e8d03f7823b75bd5838dca7b

Request headers

Referer: https://djwx9k04.eu1.hubspotlinksfree.com/Ctc/2P+113/djWx9K04/MWwcg64VshsMvKvPWxH1DPW8wLjj956wS4kN6-TNZs3m2ndW69sMD-6lZ3llW1Lb-Pq3XWR14W8mL-4Z79Rz7dW5l2p8j8Y2gJ2W3ntdlK8YcfgNVyqYTk8cj5LlW4jQ_jW8p_bJyW1gTfV74BX1H5W70fl011XDNZgW8XSkDN2K076zW2dp-YT50msm1W7x6hKB1Tr01tW1_m5Pd4Rzf19W4q0tJ96KtQ1yV1GDJG93RfTtW1fwcx23rx03JW6NjcyN2FVQKqVXlN105dsgJpW7zQ-Y01yh8CMW8qvd7f78zTpSW7RDnFT77nnk3d57Mzn04
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-CH,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 4182
Content-Type: text/html; charset=UTF-8
Date: Fri, 01 Dec 2023 15:20:43 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Fri, 01 Dec 2023 15:20:42 GMT
Keep-Alive: timeout=5, max=100
Location: ./sx.php
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34

GET
H/1.1 200
OK ni.css
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/ 1 MB
1 MB 185ms
184ms Stylesheet
text/css 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/ni.css
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: cf124a798c2b84f9af22976b5db84c58afa2844cc11272eb29aa6a37153ec6f3

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "160347-601cd7a4c2d00"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1442631

GET
H/1.1 200
OK swiz.css
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/ 4 KB
4 KB 551ms
184ms Stylesheet
text/css 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/swiz.css
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: f69dfc5327ee35b6d3667372bacdd11420b94e553a8572770bc874e007ab9e6a

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "f6f-601cd7a4c2d00"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3951

GET
H2 200 css
fonts.googleapis.com/ 58 KB
2 KB 86ms
34ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Requested by

Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

02f7e7a1131fa08bc8890d92f04fdb8487c6dc3b3d28cebd46c7b29a4fbfa0b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Fri, 01 Dec 2023 15:20:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 01 Dec 2023 15:20:34 GMT

GET
H/1.1 200
OK Logo-DiePost_Small.svg
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/ 1 KB
2 KB 560ms
184ms Image
image/svg+xml 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/Logo-DiePost_Small.svg
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: b3439b78a7313406fd7f2973c053b2f1eae06f2d9eb7fe12bf0c33abac390c95

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "536-601cd7a4c2d00"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1334

GET
H/1.1 200
OK send.png
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/ 216 KB
216 KB 567ms
184ms Image
image/png 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/send.png
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: 721e76dd768c02a0cc66b22f36cb024e069674cbd67c9893146dd1c25c397f25

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "35e71-601cd7a4c2d00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 220785

GET
H/1.1 200
OK look.png
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/ 45 KB
46 KB 557ms
186ms Image
image/png 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/look.png
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: e851b444477ad4113a23f59b30cf59bb118193f8239f75da3d226ae1c3271d34

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "b4b7-601cd7a4c2d00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 46263

GET
H/1.1 200
OK briefe.png
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/ 171 KB
172 KB 560ms
186ms Image
image/png 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/briefe.png
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: 2f859edb8d2aff1c8fb9feb0086c8cb5da29f702ddf5cbe9fde4285bbebabd9d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "2acbf-601cd7a4c2d00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 175295

GET
H/1.1 200
OK div.png
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/ 75 KB
76 KB 184ms
184ms Image
image/png 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/images/div.png
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/sx.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: 9b8f570346af42fcaf694db14c26180cc8327aa783e0360819e08ff591439d36

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www2.ltaxgo.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:44 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "12d4c-601cd7a4c2d00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 77132

GET
H/1.1 200
OK FrutigerLTW0145Light.ttf
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/fonts/ 36 KB
36 KB 186ms
186ms Font
application/font-sfnt 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/fonts/FrutigerLTW0145Light.ttf
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/swiz.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: f8f3db90b5d6af8282db3fd829a967927e8abea3797ec6b50e1a3d8d53f7fb7f

Request headers

Referer: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/swiz.css
Origin: https://www2.ltaxgo.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:46 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "8e50-601cd7a4c2d00"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 36432

GET
H/1.1 200
OK FrutigerLT65Bold.ttf
www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/fonts/ 57 KB
57 KB 184ms
184ms Font
application/font-sfnt 203.172.40.199
CSLOXINFO-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/fonts/FrutigerLT65Bold.ttf
Requested by: Host: www2.ltaxgo.net
URL: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/swiz.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.172.40.199 Bangkok, Thailand, ASN4750 (CSLOXINFO-AS-AP CS LOXINFO PUBLIC COMPANY LIMITED, TH),
Reverse DNS: reverse-203-172-40-199.csloxinfo.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34 /
Resource Hash: 07ef63cd9842e99556038c49f2fc07b849edc61e4577ddd4644f9ca0845e200e

Request headers

Referer: https://www2.ltaxgo.net/_GALLERY/01A005/L001/F734A6CB-ECA7-7BF7-5976-0C3B6582CC7F.jpeg/css/swiz.css
Origin: https://www2.ltaxgo.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 01 Dec 2023 15:20:46 GMT
Last-Modified: Mon, 31 Jul 2023 19:31:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5 PHP/7.2.34
ETag: "e3f8-601cd7a4c2d00"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 58360

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

djwx9k04.eu1.hubspotlinksfree.com
fonts.googleapis.com
test.docis.io
www2.ltaxgo.net
172.65.230.173
203.172.40.199
2a00:1450:4001:800::200a
8.219.112.240
02f7e7a1131fa08bc8890d92f04fdb8487c6dc3b3d28cebd46c7b29a4fbfa0b6
07ef63cd9842e99556038c49f2fc07b849edc61e4577ddd4644f9ca0845e200e
2f859edb8d2aff1c8fb9feb0086c8cb5da29f702ddf5cbe9fde4285bbebabd9d
5694709396ac332331519d270b3989acd497b1c0e8d03f7823b75bd5838dca7b
721e76dd768c02a0cc66b22f36cb024e069674cbd67c9893146dd1c25c397f25
9b8f570346af42fcaf694db14c26180cc8327aa783e0360819e08ff591439d36
b3439b78a7313406fd7f2973c053b2f1eae06f2d9eb7fe12bf0c33abac390c95
cf124a798c2b84f9af22976b5db84c58afa2844cc11272eb29aa6a37153ec6f3
e851b444477ad4113a23f59b30cf59bb118193f8239f75da3d226ae1c3271d34
f69dfc5327ee35b6d3667372bacdd11420b94e553a8572770bc874e007ab9e6a
f8f3db90b5d6af8282db3fd829a967927e8abea3797ec6b50e1a3d8d53f7fb7f

www2.ltaxgo.net Open in urlscan Pro 203.172.40.199 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

4 Countries

2026 kBTransfer

2084 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www2.ltaxgo.net Open in urlscan Pro
203.172.40.199 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

2026 kB
Transfer

2084 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!