securemail.focus-tours.com Open in urlscan Pro
75.126.101.229  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response securemail.focus-tours.com/	388 B 602 B	260ms 129ms	Document text/html	75.126.101.229 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL http://securemail.focus-tours.com/ Protocol HTTP/1.1 Server 75.126.101.229 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS e5.65.7e4b.ip4.static.sl-reverse.com Software nginx / Resource Hash 2b8e0df1207a6ca9f623b60e9662f87564a3e30f278d0a399a950a89af1eb0e2 Security Headers Name Value Strict-Transport-Security max-age=0; Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Type text/html; charset=UTF-8 Date Tue, 12 Apr 2022 20:43:07 GMT Server nginx Strict-Transport-Security max-age=0; Transfer-Encoding chunked
GET H/1.1	200 OK	/ Show response hotel-almas.com/a/ Frame A90D	7 KB 7 KB	821ms 124ms	Document text/html	198.49.74.2 DIMENOC
General Check archive.org Show headers Download Go to Full URL https://hotel-almas.com/a/ Requested by Host: securemail.focus-tours.com URL: http://securemail.focus-tours.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 198.49.74.2 , United States, ASN33182 (DIMENOC, US), Reverse DNS proton.dnsprotect.com Software Apache / Resource Hash abf0e882b08a289161b5b95a053ef0630d481f899d6e80ed0174f07f871f116d Request headers Referer http://securemail.focus-tours.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 7306 Content-Type text/html Date Tue, 12 Apr 2022 20:43:07 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 12 Apr 2022 18:43:18 GMT Server Apache
GET H/1.1	200 OK	83.png hotel-almas.com/a/ Frame A90D	4 KB 4 KB	123ms 123ms	Image image/png	198.49.74.2 DIMENOC
General Check archive.org Show headers Download Go to Show image Full URL https://hotel-almas.com/a/83.png Requested by Host: hotel-almas.com URL: https://hotel-almas.com/a/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 198.49.74.2 , United States, ASN33182 (DIMENOC, US), Reverse DNS proton.dnsprotect.com Software Apache / Resource Hash 5e2ea92b0b528068da05c981358318141b5f4cf8af66f0e63eb0ab59e8f1c6f7 Request headers accept-language de-DE,de;q=0.9 Referer https://hotel-almas.com/a/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Tue, 12 Apr 2022 20:43:08 GMT Last-Modified Tue, 12 Apr 2022 16:34:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3808
GET H/1.1	200 OK	38.png hotel-almas.com/a/ Frame A90D	4 KB 4 KB	123ms 123ms	Image image/png	198.49.74.2 DIMENOC
General Check archive.org Show headers Download Go to Show image Full URL https://hotel-almas.com/a/38.png Requested by Host: hotel-almas.com URL: https://hotel-almas.com/a/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 198.49.74.2 , United States, ASN33182 (DIMENOC, US), Reverse DNS proton.dnsprotect.com Software Apache / Resource Hash dc085ea274ccea414b19ba730080659baca694f0982f69feb85bf55aa87e3129 Request headers accept-language de-DE,de;q=0.9 Referer https://hotel-almas.com/a/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Tue, 12 Apr 2022 20:43:08 GMT Last-Modified Tue, 12 Apr 2022 16:34:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3775

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hotel-almas.com
securemail.focus-tours.com
198.49.74.2
75.126.101.229
2b8e0df1207a6ca9f623b60e9662f87564a3e30f278d0a399a950a89af1eb0e2
5e2ea92b0b528068da05c981358318141b5f4cf8af66f0e63eb0ab59e8f1c6f7
abf0e882b08a289161b5b95a053ef0630d481f899d6e80ed0174f07f871f116d
dc085ea274ccea414b19ba730080659baca694f0982f69feb85bf55aa87e3129