www.news-service-umstellung.xyz
Open in
urlscan Pro
2606:4700:3030::6812:2751
Malicious Activity!
Public Scan
URL:
https://www.news-service-umstellung.xyz/sites/default/files
Submission: On February 21 via automatic, source openphish
Submission: On February 21 via automatic, source openphish
Summary
This website contacted 4 IPs
in 2 countries
across 4 domains to perform 66 HTTP transactions.
The main IP is 2606:4700:3030::6812:2751, located in
United States and
belongs to CLOUDFLARENET, US.
The main domain is www.news-service-umstellung.xyz.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 27th 2019. Valid for: 10 months.
This is the only time www.news-service-umstellung.xyz was scanned on urlscan.io!
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 27th 2019. Valid for: 10 months.
This is the only time www.news-service-umstellung.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 45 | 2606:4700:303... 2606:4700:3030::6812:2751 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 7 | 2606:4700::68... 2606:4700::6811:4104 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 7 | 23.45.105.205 23.45.105.205 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 7 | 66.211.173.44 66.211.173.44 | 11643 (EBAY) (EBAY) | |
| 66 | 4 |
45
2606:4700:3030::6812:2751
(United States)
ASN13335 (CLOUDFLARENET, US)
ASN13335 (CLOUDFLARENET, US)
| www.news-service-umstellung.xyz |
7
23.45.105.205
(Netherlands)
ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-105-205.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-105-205.deploy.static.akamaitechnologies.com
| c.paypal.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 45 |
news-service-umstellung.xyz
www.news-service-umstellung.xyz |
633 KB |
| 7 |
ebayrtm.com
srv.de.ebayrtm.com |
2 KB |
| 7 |
paypal.com
c.paypal.com |
123 KB |
| 7 |
cloudflare.com
ajax.cloudflare.com |
28 KB |
| 66 | 4 |
| Domain | Requested by | |
|---|---|---|
| 45 | www.news-service-umstellung.xyz |
www.news-service-umstellung.xyz
ajax.cloudflare.com |
| 7 | srv.de.ebayrtm.com |
www.news-service-umstellung.xyz
|
| 7 | c.paypal.com |
www.news-service-umstellung.xyz
|
| 7 | ajax.cloudflare.com |
www.news-service-umstellung.xyz
|
| 66 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| pages.ebay.de |
| cgi6.ebay.de |
| trustsealinfo.websecurity.norton.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-11-27 - 2020-10-09 |
10 months | crt.sh |
| cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
| c.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-13 |
2 years | crt.sh |
| srv.ebayrtm.com DigiCert SHA2 Secure Server CA |
2019-03-27 - 2020-03-27 |
a year | crt.sh |
This page contains 22 frames:
Primary Page:
https://www.news-service-umstellung.xyz/sites/default/files
Frame ID: D4BC345A034C05A92F391DBFB5E8CD63
Requests: 7 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//t_n.htm
Frame ID: A551B6AD0EAD261FD22D1AC4F01B8679
Requests: 7 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//images//t_n.htm
Frame ID: F4DB80C7B6B6197CBA640EB4AD3E017D
Requests: 7 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//images//images//t_n.htm
Frame ID: D9B2B63C5ED02375D88E6ABF9FC1814C
Requests: 7 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//images//images//images//t_n.htm
Frame ID: 0036848114A47D91B838E7DBC3F06148
Requests: 7 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//t_n.htm
Frame ID: D7DB18215DD8F02DF310BC9D2EC677F1
Requests: 7 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//t_n.htm
Frame ID: 4044311390C37256175751582FEB2832
Requests: 8 HTTP requests in this frame
Frame:
https://www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images//t_n.htm
Frame ID: 4243D819F62F2BCDE883B02B09B562B2
Requests: 2 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: 3647CB5CA1CED7268D2C1DFBF785EAD5
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: BB8C9787B42FA53488F1EECAD64059D0
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: 4E338A4C255FC6FBA7529DD19C0719F7
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: CF3CB54C0CC71B884533FC4E4F592C31
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: 6735AD784A9C344403BBFACABB63E581
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: 7B692D334BB35D3D2B58A39C4BE76F7C
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: F2F16163A9F0C7D663AE1E4927E98A37
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: 081DDBECB3464A160152837265D4C929
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: 6AF7E9091300C567FB3F5AC2856B5904
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: 04FAE05285F18B9BE4758E22BA51986C
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: A1EA1DA271A6DCE3878F9F59E77BEFD7
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: F3458FE96E123866A16DCC3CDFF307BB
Requests: 1 HTTP requests in this frame
Frame:
https://c.paypal.com/da/r/fb.js
Frame ID: 22A4C75D8F6ADD98318ACB850C10EF1A
Requests: 1 HTTP requests in this frame
Frame:
https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=1516bb461660ad4cc7d8938affffffff&cb=parent.window.updateRtmField
Frame ID: 649A27158C9DDADC80F15B3C674495E7
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://pages.ebay.de/help/policies/user-agreement.html
Title: eBay-AGB
Title: eBay-AGB
Search URL Search Domain Scan URL
URL: https://pages.ebay.de/help/policies/privacy-policy.html
Title: Datenschutzerklärung
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
URL: https://pages.ebay.de/help/account/cookies-web-beacons.html
Title: Cookies
Title: Cookies
Search URL Search Domain Scan URL
URL: https://cgi6.ebay.de/ws/eBayISAPI.dll?AdChoiceLandingPage&partner=0
Title: AdChoice
Title: AdChoice
Search URL Search Domain Scan URL
URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.de&lang=de
Title: Norton Secured - powered by Verisign
Title: Norton Secured - powered by Verisign
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
66 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
files
www.news-service-umstellung.xyz/sites/default/ |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images/ |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images/ |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images/ |
39 KB 39 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images// Frame A551 |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images// |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images// |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images//images/ Frame A551 |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images//images/ Frame A551 |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images//images/ Frame A551 |
39 KB 39 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ Frame A551 |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images//images// Frame F4DB |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images// Frame A551 |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images//images// Frame A551 |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images//images//images/ Frame F4DB |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images//images//images/ Frame F4DB |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images//images//images/ Frame F4DB |
39 KB 39 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ Frame F4DB |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images//images//images// Frame D9B2 |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images//images// Frame F4DB |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images//images//images// Frame F4DB |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images/ Frame D9B2 |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images/ Frame D9B2 |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images//images//images//images/ Frame D9B2 |
39 KB 39 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ Frame D9B2 |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images//images//images//images// Frame 0036 |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images//images//images// Frame D9B2 |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images//images//images//images// Frame D9B2 |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images/ Frame 0036 |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images/ Frame 0036 |
127 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images/ Frame 0036 |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ Frame 0036 |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images// Frame D7DB |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images// Frame 0036 |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images// Frame 0036 |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images/ Frame D7DB |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images/ Frame D7DB |
39 KB 14 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images/ Frame D7DB |
39 KB 39 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ Frame D7DB |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images// Frame 4044 |
39 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images// Frame D7DB |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images// Frame D7DB |
39 KB 14 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3sbepdq10q0dtksnrmgitl41cm0.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images/ Frame 4044 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-4a48a6.css
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images/ Frame 4044 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images/ Frame 4044 |
859 B 859 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ Frame 4044 |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t_n.htm
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images// Frame 4243 |
859 B 932 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images// Frame 4044 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0vk0rkyoky1ltm32dhy0hthnxyx.js
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images// Frame 4044 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
email-decode.min.js
www.news-service-umstellung.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/ Frame 4243 |
1 KB 833 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame 3647 |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame BB8C |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame 4E33 |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame CF3C |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame 6735 |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame 7B69 |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame F2F1 |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame 081D |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame 6AF7 |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame 04FA |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame A1EA |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame F345 |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.js
c.paypal.com/da/r/ Frame 22A4 |
51 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
inflowcomponent
www.news-service-umstellung.xyz/sites/default/images//images//images//images//images//images//images// Frame 4044 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rtm
srv.de.ebayrtm.com/ Frame 649A |
56 B 327 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| __cfQR number| $ssgST boolean| useCustomFont object| globalDfpContext undefined| oDFP undefined| dfpDetails undefined| dom object| doc object| where object| iframe function| handleParentCallBackForSocial function| otpSubmit boolean| __cfRLUnblockHandlers string| rtmAsyncURL function| updateRtmField2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.news-service-umstellung.xyz/ | Name: PHPSESSID Value: are6qgtsm754kv5u20glqj0nnf |
|
| .news-service-umstellung.xyz/ | Name: __cfduid Value: de958d0b1de40f1792395dd242ff9bcaf1582245636 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
c.paypal.com
srv.de.ebayrtm.com
www.news-service-umstellung.xyz
23.45.105.205
2606:4700:3030::6812:2751
2606:4700::6811:4104
66.211.173.44
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2bc1c32e1931cd7cf1fe4dee6b24d931a46c5e2622b31175422da52aecf55707
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
803b2a9f6bad0794919c893aff445bcca329b3eb5183aa0e482b7b602655e081
a434145c942abd73cdc8c724935753184310ccaa0b018ea007790fd840a8595d
a5d8a7f09bd1c978ae915346bf2f46207a6c9f26572e16b07520556b889a72ef
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
def1709b77d3d2618e033ff7ae8b611292791962d66f7fd08f0a845aed41b5ee
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c
f0c5e579180b1b73500d58ac80907d27357e38a2700efe72469136d45eafb094