webmail.eswe.com - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 91.26.201.182, located in Herne, Germany and belongs to DTAG Internet service provider operations, DE. The main domain is webmail.eswe.com.
TLS certificate: Issued by R10 on August 19th 2024. Valid for: 3 months.

This is the only time webmail.eswe.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 4	91.26.201.182 91.26.201.182	3320 (DTAG Inte...) (DTAG Internet service provider operations)
1	217.19.190.243 217.19.190.243	28676 (WITCOM-AS) (WITCOM-AS)
3	3

4 91.26.201.182 (Herne, Germany) 2 redirects

ASN3320 (DTAG Internet service provider operations, DE)

outlook.eswe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
webmail.eswe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.19.190.243 (Wiesbaden, Germany)

ASN28676 (WITCOM-AS, DE)
PTR: 190-243.access.witcom.de

www.eswe-versorgung.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	eswe.com 2 redirects outlook.eswe.com webmail.eswe.com	31 KB
1	eswe-versorgung.de www.eswe-versorgung.de	14 KB
3	2

	Domain	Requested by
3	webmail.eswe.com	1 redirects
1	www.eswe-versorgung.de	webmail.eswe.com
1	outlook.eswe.com	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
webmail.eswe.com R10	`2024-08-19` - `2024-11-17`	3 months	crt.sh
eswe-versorgung.de R10	`2024-07-10` - `2024-10-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://webmail.eswe.com/owa
Frame ID: 6E9088CEDA773B6AA405337F2974FC53
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook WebApp

Page URL History Show full URLs

http://outlook.eswe.com/ HTTP 307
https://outlook.eswe.com/ HTTP 301
https://webmail.eswe.com/owa Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

45 kB
Transfer

118 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://outlook.eswe.com/ HTTP 307
https://outlook.eswe.com/ HTTP 301
https://webmail.eswe.com/owa Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://webmail.eswe.com/favicon.ico HTTP 301
https://webmail.eswe.com/owa

3 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request owa Show response
webmail.eswe.com/
Redirect Chain

http://outlook.eswe.com/
https://outlook.eswe.com/
https://webmail.eswe.com/owa

15 KB
16 KB

65ms
17ms

Document
text/html

91.26.201.182
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.eswe.com/owa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.26.201.182 Herne, Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: /
Resource Hash: 4cdd8caa6dcb55d6e8da8c16a216c7d8876ee4cbd442e66ee98b50c9ff4f4aa3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store
Content-Length: 15626
Content-Type: text/html

Redirect headers

Content-Length: 98
Content-Type: text/html
Location: https://webmail.eswe.com/owa

GET
H/1.1 200
OK styles_responsive.css
www.eswe-versorgung.de/ 78 KB
14 KB 104ms
35ms Stylesheet
text/css 217.19.190.243
WITCOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.eswe-versorgung.de/styles_responsive.css

Requested by

Host: webmail.eswe.com
URL: https://webmail.eswe.com/owa

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

217.19.190.243 Wiesbaden, Germany, ASN28676 (WITCOM-AS, DE),

Reverse DNS

190-243.access.witcom.de

Software

Apache /

Resource Hash

7c9b1fdee5abb849c8ed9a2218673feb4ba476c0a0091c8353ce4594b3da9691

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff

Request headers

Referer: https://webmail.eswe.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Mon, 19 Aug 2024 09:28:18 GMT
Strict-Transport-Security: max-age=63072000
X-Content-Type-Options: nosniff
Last-Modified: Wed, 07 Aug 2024 13:42:18 GMT
Server: Apache
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/css; charset=utf-8
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 13846
Expires: Tue, 19 Aug 2025 09:28:18 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

owa
webmail.eswe.com/
Redirect Chain

https://webmail.eswe.com/favicon.ico
https://webmail.eswe.com/owa

15 KB
15 KB

17ms
17ms

Other
text/html

91.26.201.182
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://webmail.eswe.com/owa
Protocol: HTTP/1.1
Server: 91.26.201.182 Herne, Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: /
Resource Hash: 33c0da7b1c267751d5293618611a78aad1da639039489d289e9af8bd0a5eb7ad

Request headers

Referer: https://webmail.eswe.com/owa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store
Content-Length: 15626
Content-Type: text/html

Redirect headers

Location: https://webmail.eswe.com/owa
Content-Length: 98
Content-Type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| window_onload function| checkSubmit function| SubmitForm

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.webmail.eswe.com/owa	1969-12-31 23:59:59	Name: cookiesession3 Value: Rm9ydGl3ZWIK
			webmail.eswe.com/	1970-01-21 07:39:55	Name: cookiesession1 Value: 678A3E3159A9F5747722BE3EBA604BFE

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

outlook.eswe.com
webmail.eswe.com
www.eswe-versorgung.de
217.19.190.243
91.26.201.182
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
33c0da7b1c267751d5293618611a78aad1da639039489d289e9af8bd0a5eb7ad
4cdd8caa6dcb55d6e8da8c16a216c7d8876ee4cbd442e66ee98b50c9ff4f4aa3
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
7c9b1fdee5abb849c8ed9a2218673feb4ba476c0a0091c8353ce4594b3da9691
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

webmail.eswe.com Open in urlscan Pro 91.26.201.182 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

45 kBTransfer

118 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

2 Cookies

Indicators

webmail.eswe.com Open in urlscan Pro
91.26.201.182 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

45 kB
Transfer

118 kB
Size

2
Cookies

3 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!