the-travel-club.de Open in urlscan Pro
2a01:238:20a:202:1065::  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://citologialiquida.ind.br/libraries/rokcommon/login.php Page URL
2. https://the-travel-club.de/EMPT/contact_form.htm Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	login.php citologialiquida.ind.br/libraries/rokcommon/	130 B 373 B	717ms 226ms	Document text/html	187.17.111.35 Universo Online S.A.
General Check archive.org Show headers Download Go to Full URL https://citologialiquida.ind.br/libraries/rokcommon/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 187.17.111.35 , Brazil, ASN7162 (Universo Online S.A., BR), Reverse DNS Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 06 Dec 2023 10:08:20 GMT Server Apache Transfer-Encoding chunked X-App-Status 1 X-Cache-Status BYPASS
GET H2	200	Primary Request contact_form.htm Show response the-travel-club.de/EMPT/	1 KB 770 B	205ms 67ms	Document text/html	2a01:238:20a:202:1065:: STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://the-travel-club.de/EMPT/contact_form.htm Requested by Host: citologialiquida.ind.br URL: https://citologialiquida.ind.br/libraries/rokcommon/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a01:238:20a:202:1065:: , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS Software Apache/2.4.58 (Unix) / Resource Hash 448ad1a62bc92b69cda8ad10ad18c0e9d12be1274055ca17d41fad6308b26964 Request headers Referer https://citologialiquida.ind.br/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 625 content-type text/html date Wed, 06 Dec 2023 10:08:20 GMT etag "4e9-60bd1871704c8" last-modified Wed, 06 Dec 2023 06:33:22 GMT server Apache/2.4.58 (Unix) vary Accept-Encoding
GET H2	200	jquery.js Show response redniva.ru/images/	28 KB 5 KB	605ms 75ms	Script application/javascript	86.110.220.166 RU-JSCIOT
General Check archive.org Show headers Download Go to Full URL https://redniva.ru/images/jquery.js Requested by Host: the-travel-club.de URL: https://the-travel-club.de/EMPT/contact_form.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 86.110.220.166 , Russian Federation, ASN29182 (RU-JSCIOT, RU), Reverse DNS moovixhost.ru Software nginx/1.18.0 / Resource Hash 54c9f9a26e6964d98c9e56070e54b64e776dfec2e82b1272939e1e8c647870c7 Request headers Referer https://the-travel-club.de/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 06 Dec 2023 10:08:21 GMT content-encoding gzip last-modified Mon, 04 Dec 2023 12:05:22 GMT server nginx/1.18.0 etag W/"656dc082-718c" content-type application/javascript; charset=UTF-8 cache-control max-age=2592000 expires Fri, 05 Jan 2024 10:08:21 GMT
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	94ms 32ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: redniva.ru URL: https://redniva.ru/images/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://the-travel-club.de/ Origin https://the-travel-club.de accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 06 Dec 2023 10:08:21 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1254685 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-man4132-MAN last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1701857301.148100,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 8, 139011
GET H2	200	ffTjWfv.png i.imgur.com/	1 KB 2 KB	151ms 47ms	Image image/png	146.75.120.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/ffTjWfv.png Requested by Host: redniva.ru URL: https://redniva.ru/images/jquery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 09a2748730d6feb7a146d76c6cdfedd2d5394d63f908058fa8adaf29810bf849 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://the-travel-club.de/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 10:08:21 GMT strict-transport-security max-age=300 x-content-type-options nosniff x-amz-cf-pop JFK50-P6 age 285772 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront, HIT, HIT content-length 1425 x-served-by cache-iad-kjyo7100117-IAD, cache-fra-etou8220115-FRA last-modified Sun, 03 Dec 2023 02:45:29 GMT server cat factory 1.0 x-timer S1701857301.192436,VS0,VE3 etag "9b61cfa60e3a5813c2e5312142dacb37" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-amz-cf-id yyI07Ds5I_WbTU4w4_dM0bXcEQp6O-g2zt33lW6MvWJphqSChH7EfQ== x-cache-hits 6, 1
GET H2	200	4R3ihSa.png i.imgur.com/	135 KB 136 KB	46ms 45ms	Image image/png	146.75.120.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/4R3ihSa.png Requested by Host: the-travel-club.de URL: https://the-travel-club.de/EMPT/contact_form.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash ffdf9b07597e8a8b26abaa3574ce1fc102e6f9e26ddb0afba7a117ed78fc14f9 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://the-travel-club.de/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 10:08:21 GMT strict-transport-security max-age=300 x-content-type-options nosniff x-amz-cf-pop JFK50-P6 age 285496 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront, HIT, HIT content-length 138577 x-served-by cache-iad-kcgs7200114-IAD, cache-fra-etou8220115-FRA last-modified Sun, 03 Dec 2023 02:50:05 GMT server cat factory 1.0 x-timer S1701857301.208662,VS0,VE2 etag "b8c8b56f2a2a026a4213e230a02ab134" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-amz-cf-id yUzUvLD4SlkDJ6PsXlrwIkKnrQSxpFhXTAtaQHmkdR8gGPNLHdkh1A== x-cache-hits 31, 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TSB Bank (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| _0x2ecb function| _0x4b388b function| _0x1195 string| btokenbot string| chatidchat string| queryControlBase64 function| _0x32d4 function| _0x20e3 function| $ function| jQuery function| _0x3868 function| _0x29c4 function| _0x3eb682

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://the-travel-club.de/EMPT/contact_form.htm(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://redniva.ru/images/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://the-travel-club.de/EMPT/contact_form.htm(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://redniva.ru/images/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://redniva.ru/images/jquery.js(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://redniva.ru/images/jquery.js(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

citologialiquida.ind.br
code.jquery.com
i.imgur.com
redniva.ru
the-travel-club.de
146.75.120.193
187.17.111.35
2a01:238:20a:202:1065::
2a04:4e42:400::649
86.110.220.166
09a2748730d6feb7a146d76c6cdfedd2d5394d63f908058fa8adaf29810bf849
448ad1a62bc92b69cda8ad10ad18c0e9d12be1274055ca17d41fad6308b26964
54c9f9a26e6964d98c9e56070e54b64e776dfec2e82b1272939e1e8c647870c7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ffdf9b07597e8a8b26abaa3574ce1fc102e6f9e26ddb0afba7a117ed78fc14f9