fo-net.de Open in urlscan Pro
81.88.32.138 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ftp.cnc.fr/ssl3/
Effective URL:
https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Submission: On December 04 via api (December 4th 2022, 9:02:32 pm UTC) from IE — Scanned from FR

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 81.88.32.138, located in Germany and belongs to KOMPLEX-AS Winkelhauser Str. 63, DE. The main domain is fo-net.de.
TLS certificate: Issued by R3 on November 28th 2022. Valid for: 3 months.

This is the only time fo-net.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation) Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	185.113.40.118 185.113.40.118	12601 (CEGEDIM) (CEGEDIM)
12	81.88.32.138 81.88.32.138	24973 (KOMPLEX-A...) (KOMPLEX-AS Winkelhauser Str. 63)
6	2a02:26f0:350... 2a02:26f0:3500:16::215:148f	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
19	3

1 185.113.40.118 (France)

ASN12601 (CEGEDIM, FR)
PTR: ip-185-113-40-118.infra.cegedim.org

ftp.cnc.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 81.88.32.138 (Germany)

ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE)
PTR: hkhttp1a1-138.kontent.com

fo-net.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:3500:16::215:148f (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	fo-net.de fo-net.de	279 KB
6	typekit.net use.typekit.net — Cisco Umbrella Rank: 532
1	cnc.fr ftp.cnc.fr	371 B
19	3

	Domain	Requested by
12	fo-net.de	fo-net.de
6	use.typekit.net	fo-net.de
1	ftp.cnc.fr
19	3

This site contains no links.

Subject Issuer	Validity	Valid
*.cnc.fr Sectigo RSA Organization Validation Secure Server CA	`2022-08-31` - `2023-09-18`	a year	crt.sh
*.fo-net.de R3	`2022-11-28` - `2023-02-26`	3 months	crt.sh
use.typekit.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-14` - `2023-10-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Frame ID: 271A9916A814FC71BD15A5D13352DCA2
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL - Wählen Sie die Zahlungsmethode

Page URL History Show full URLs

https://ftp.cnc.fr/ssl3/ Page URL
https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<input[^>]+name="__VIEWSTATE

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui[.-]([\d.]*\d)[^/]*\.js
jquery-ui.*\.js

Page Statistics

19
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

280 kB
Transfer

1208 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ftp.cnc.fr/ssl3/ Page URL
https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode?? Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
ftp.cnc.fr/ssl3/ 171 B
371 B 151ms
20ms Document
text/html 185.113.40.118
CEGEDIM

General

Check archive.org

Show headers Download Go to

Full URL

https://ftp.cnc.fr/ssl3/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.113.40.118 , France, ASN12601 (CEGEDIM, FR),

Reverse DNS

ip-185-113-40-118.infra.cegedim.org

Software

Resource Hash

dc91e61e82378e497b4f625c8a89b5213093eadf7cf3f265d30e8e3e45c64a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Content-Length: 171
Content-Type: text/html; charset=UTF-8
Date: Sun, 04 Dec 2022 21:02:27 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Cnection: close

GET
H/1.1 200
OK Primary Request Zahlungsmethode.php Show response
fo-net.de/1/POST/DE/Package/ 28 KB
7 KB 899ms
378ms Document
text/html 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 / PHP/7.4.10-kon
Resource Hash: 4522f13bb7d6e361955aa003fd9d236bc2dd90e0e993e3237b5837d4d25910a8

Request headers

Referer: https://ftp.cnc.fr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 04 Dec 2022 21:02:28 GMT
Server: nginx/1.14.2
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.10-kon

GET
H/1.1 200
OK typeKit.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 17 KB
7 KB 182ms
88ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/typeKit.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 930ad5dea1b3b02af5ef625060b7408d96b951febc9d0d26472b0ae7ea032f43

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:59 GMT
Server: nginx/1.14.2
ETag: "41564238-45f0-5eefdff33e367"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7190

GET
H/1.1 200
OK bootstrap.css
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 143 KB
21 KB 113ms
99ms Stylesheet
text/css 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/bootstrap.css
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 7e630d90c7234b0df1729f62b8f9e4bbfaf293d91a5a0ac46df25f2a6759e39a

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:47 GMT
Server: nginx/1.14.2
ETag: "4156422a-23a5d-5eefdfe85ffc6"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21340

GET
H/1.1 200
OK main.css
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 21 KB
4 KB 177ms
91ms Stylesheet
text/css 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/main.css
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 4eb6726dad2deb2caa31a7636ca2aaa8226f88eefd4a1243fe1eca40c6619b03

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:52 GMT
Server: nginx/1.14.2
ETag: "41564230-5366-5eefdfed04767"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3699

GET
H/1.1 200
OK jquery-1.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 242 KB
71 KB 207ms
113ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/jquery-1.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 9fcc241093405946885039df428cfa7f0051a1f2bdbcc5a313a177a9e35f8806

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:50 GMT
Server: nginx/1.14.2
ETag: "4156422b-3c9ab-5eefdfeb4a146"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes

GET
H/1.1 200
OK jquery-1_002.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 92 KB
33 KB 197ms
103ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/jquery-1_002.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:51 GMT
Server: nginx/1.14.2
ETag: "4156422c-16eac-5eefdfeb83b26"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33140

GET
H/1.1 200
OK jquery-ui-1.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 206 KB
51 KB 225ms
130ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/jquery-ui-1.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 794bf1ff4b8bbc981cb280b4efeb6e5b040afb34b85f6e3cd2546ace15910301

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:53 GMT
Server: nginx/1.14.2
ETag: "4156422f-337d6-5eefdfee296e7"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 52239

GET
H/1.1 200
OK WebResource.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 21 KB
5 KB 229ms
62ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/WebResource.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: 30dda8f0c7ba8b8851e08bd6e41548305f507b9328a114b1f3da0800e708854f

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:26:01 GMT
Server: nginx/1.14.2
ETag: "41564239-5515-5eefdff50f0e7"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4401

GET
H/1.1 200
OK ScriptResource_002.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 342 KB
60 KB 278ms
101ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ScriptResource_002.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: c7d19ae5c2759a30bd5a55e617c8c59797c0280464b3701232b3214beadcc013

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:26:00 GMT
Server: nginx/1.14.2
ETag: "41564237-55697-5eefdff4b14e7"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 60743

GET
H/1.1 200
OK ScriptResource.js Show response
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 91 KB
15 KB 253ms
74ms Script
application/javascript 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ScriptResource.js
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: ff94c56174be8fe0bc2d2809fe7f7fd2e566ae3fc81e90690f1ee64816f697bb

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Dec 2022 10:25:57 GMT
Server: nginx/1.14.2
ETag: "41564236-16d33-5eefdff120387"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15160

GET
H/1.1 200
OK dhl-logo.png
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 3 KB
3 KB 122ms
122ms Image
image/png 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/dhl-logo.png
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: ab60f539dd6a842d37a1b79c0b2b4a5bc7e4574835ee7251d3aa5a7d456ac36f

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:29 GMT
Last-Modified: Sun, 04 Dec 2022 10:25:46 GMT
Server: nginx/1.14.2
ETag: "4156422d-c6e-5eefdfe71cbe6"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3182

GET
H/1.1 200
OK ogilvy-iconoTarjeta.png
fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ 1 KB
1 KB 120ms
119ms Image
image/png 81.88.32.138
KOMPLEX-AS Winkel...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fo-net.de/1/POST/DE/Package/Seleccione%20medio%20de%20pago_fichiers/ogilvy-iconoTarjeta.png
Requested by: Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 81.88.32.138 , Germany, ASN24973 (KOMPLEX-AS Winkelhauser Str. 63, DE),
Reverse DNS: hkhttp1a1-138.kontent.com
Software: nginx/1.14.2 /
Resource Hash: ecc047250aed883bd0038ba4cdf2b4b7f7105e28fae93712ad1a9090b014a9c9

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

Date: Sun, 04 Dec 2022 21:02:29 GMT
Last-Modified: Sun, 04 Dec 2022 10:25:54 GMT
Server: nginx/1.14.2
ETag: "41564231-4a8-5eefdfeee00c7"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1192

GET
H2 404 l
use.typekit.net/af/7505b0/0000000000000000000124fa/27/ 0
0 228ms
122ms Font
text/plain 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Requested by

Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://fo-net.de/
Origin: https://fo-net.de
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
date: Sun, 04 Dec 2022 21:02:29 GMT
server: nginx
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9

GET
H2 404 l
use.typekit.net/af/802da8/0000000000000000000124f9/27/ 0
0 226ms
120ms Font
text/plain 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/802da8/0000000000000000000124f9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Requested by

Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://fo-net.de/
Origin: https://fo-net.de
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
date: Sun, 04 Dec 2022 21:02:29 GMT
server: nginx
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9

GET
H2 404 d
use.typekit.net/af/802da8/0000000000000000000124f9/27/ 0
0 119ms
118ms Font
text/plain 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/802da8/0000000000000000000124f9/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Requested by

Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://fo-net.de/
Origin: https://fo-net.de
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
date: Sun, 04 Dec 2022 21:02:29 GMT
server: nginx
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9

GET
H2 404 d
use.typekit.net/af/7505b0/0000000000000000000124fa/27/ 0
0 120ms
119ms Font
text/plain 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Requested by

Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://fo-net.de/
Origin: https://fo-net.de
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
date: Sun, 04 Dec 2022 21:02:29 GMT
server: nginx
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9

GET
H2 404 a
use.typekit.net/af/802da8/0000000000000000000124f9/27/ 0
0 121ms
120ms Font
text/plain 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/802da8/0000000000000000000124f9/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Requested by

Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://fo-net.de/
Origin: https://fo-net.de
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
date: Sun, 04 Dec 2022 21:02:29 GMT
server: nginx
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9

GET
H2 404 a
use.typekit.net/af/7505b0/0000000000000000000124fa/27/ 0
0 119ms
119ms Font
text/plain 2a02:26f0:3500:16::215:148f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Requested by

Host: fo-net.de
URL: https://fo-net.de/1/POST/DE/Package/Zahlungsmethode.php?NAME_PATH=track_yy_de349499l24&SCREEN=Zahlungsmethode??

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Referer: https://fo-net.de/
Origin: https://fo-net.de
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
date: Sun, 04 Dec 2022 21:02:29 GMT
server: nginx
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation) Generic (Online)

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://use.typekit.net/af/802da8/0000000000000000000124f9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://use.typekit.net/af/802da8/0000000000000000000124f9/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://use.typekit.net/af/802da8/0000000000000000000124f9/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fo-net.de
ftp.cnc.fr
use.typekit.net
185.113.40.118
2a02:26f0:3500:16::215:148f
81.88.32.138
30dda8f0c7ba8b8851e08bd6e41548305f507b9328a114b1f3da0800e708854f
4522f13bb7d6e361955aa003fd9d236bc2dd90e0e993e3237b5837d4d25910a8
4eb6726dad2deb2caa31a7636ca2aaa8226f88eefd4a1243fe1eca40c6619b03
794bf1ff4b8bbc981cb280b4efeb6e5b040afb34b85f6e3cd2546ace15910301
7e630d90c7234b0df1729f62b8f9e4bbfaf293d91a5a0ac46df25f2a6759e39a
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
930ad5dea1b3b02af5ef625060b7408d96b951febc9d0d26472b0ae7ea032f43
9fcc241093405946885039df428cfa7f0051a1f2bdbcc5a313a177a9e35f8806
ab60f539dd6a842d37a1b79c0b2b4a5bc7e4574835ee7251d3aa5a7d456ac36f
c7d19ae5c2759a30bd5a55e617c8c59797c0280464b3701232b3214beadcc013
dc91e61e82378e497b4f625c8a89b5213093eadf7cf3f265d30e8e3e45c64a5c
ecc047250aed883bd0038ba4cdf2b4b7f7105e28fae93712ad1a9090b014a9c9
ff94c56174be8fe0bc2d2809fe7f7fd2e566ae3fc81e90690f1ee64816f697bb

fo-net.de Open in urlscan Pro 81.88.32.138 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

280 kBTransfer

1208 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

63 JavaScript Global Variables

0 Cookies

6 Console Messages

Security Headers

Indicators

fo-net.de Open in urlscan Pro
81.88.32.138 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

280 kB
Transfer

1208 kB
Size

0
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!