urlscan.io logo urlscan.io
SecurityTrails logo

reprobaran.ru.com Open in urlscan Pro
81.17.30.236  Public Scan

Go To Rescan Add Verdict Report
URL: https://reprobaran.ru.com/login.html
Submission Tags: @ecarlesi possiblethreat phishing immowelt Search All
Submission: On October 19 via api from IT — Scanned from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 81.17.30.236, located in Zurich, Switzerland and belongs to PLI-AS, PA. The main domain is reprobaran.ru.com.
TLS certificate: Issued by R11 on October 16th 2024. Valid for: 3 months.
This is the only time reprobaran.ru.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 81.17.30.236 51852 (PLI-AS)
1 2600:9000:235... 16509 (AMAZON-02)
1 18.157.216.229 16509 (AMAZON-02)
4 18.66.122.14 16509 (AMAZON-02)
1 99.86.4.63 16509 (AMAZON-02)
8 5
1    81.17.30.236 (Zurich, Switzerland)

ASN51852 (PLI-AS, PA)
PTR: hostedby.privatelayer.com
reprobaran.ru.com
1    2600:9000:2359:be00:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)
cdn.auth0.com
1    18.157.216.229 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-216-229.eu-central-1.compute.amazonaws.com
images.immowelt.de
4    18.66.122.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-14.fra60.r.cloudfront.net
signin.immowelt.de
1    99.86.4.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-63.fra6.r.cloudfront.net
smartdesign.immowelt.org
Apex Domain
Subdomains		 Transfer
5 immowelt.de
images.immowelt.de
signin.immowelt.de
161 KB
1 immowelt.org
smartdesign.immowelt.org — Cisco Umbrella Rank: 614225
31 KB
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 6411
63 KB
1 ru.com
reprobaran.ru.com
27 KB
8 4
Domain Requested by
4 signin.immowelt.de reprobaran.ru.com
1 smartdesign.immowelt.org reprobaran.ru.com
1 images.immowelt.de reprobaran.ru.com
1 cdn.auth0.com reprobaran.ru.com
1 reprobaran.ru.com
8 5

This site contains links to these domains. Also see Links.

Domain
immowelt.de
Subject Issuer Validity Valid
reprobaran.ru.com
R11		 2024-10-16 -
2025-01-14		 3 months crt.sh
*.auth0.com
Amazon RSA 2048 M03		 2024-01-25 -
2025-02-22		 a year crt.sh
*.immowelt.de
Amazon RSA 2048 M02		 2023-11-29 -
2024-12-27		 a year crt.sh
signin.immowelt.de
Amazon RSA 2048 M03		 2023-12-13 -
2025-01-11		 a year crt.sh
smartdesign.immowelt.org
Amazon RSA 2048 M02		 2024-08-23 -
2025-09-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://reprobaran.ru.com/login.html
Frame ID: 80227A1EA2B4BEBF95104264C4F60FCF
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login | immowelt

Page Statistics

8
Requests

100 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

283 kB
Transfer

495 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.html
reprobaran.ru.com/ 		27 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://reprobaran.ru.com/login.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
81.17.30.236 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatelayer.com
Software
Apache /
Resource Hash
4021457f53ff4cd03e9e600cf0a86316ccd74d6f2c2b4ef45046719efe48bb22

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
27364
Content-Type
text/html
Date
Sat, 19 Oct 2024 02:16:49 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Thu, 10 Oct 2024 18:51:32 GMT
Server
Apache
main.cdn.min.css
cdn.auth0.com/ulp/react-components/1.94.16/css/ 		278 KB
63 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.auth0.com/ulp/react-components/1.94.16/css/main.cdn.min.css
Requested by
Host: reprobaran.ru.com
URL: https://reprobaran.ru.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2359:be00:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd1b140895c612933c8f0eff3d1c4d9623f5390ab384fb5a29880f2d9c6f2430
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://reprobaran.ru.com/

Response headers

x-robots-tag
noindex
content-encoding
gzip
x-amz-version-id
dPmqtweQgo85dcCRck6mkVHwfsNGrXFJ
etag
W/"8fe5c4a4114712386d196e247b581978"
age
72740
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
kfg3e3msF79lgC_8_IiP422eQqseGUrT69AHXakSQEj12TN_D4UQqA==
date
Fri, 18 Oct 2024 06:04:30 GMT
content-type
text/css
vary
Accept-Encoding
last-modified
Tue, 13 Aug 2024 12:22:09 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-amz-replication-status
FAILED
cache-control
max-age=86400
via
1.1 c630c028c0123d2a5e8fa36e68049386.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P10
server
AmazonS3
x-amz-server-side-encryption
AES256
iw_logo_default.png
images.immowelt.de/E-Mail_Marketing/_logos/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.immowelt.de/E-Mail_Marketing/_logos/iw_logo_default.png
Requested by
Host: reprobaran.ru.com
URL: https://reprobaran.ru.com/login.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.157.216.229 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-157-216-229.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
23729bb1b1ac82ace6e9b02bba7f2bfbc0d34825521b300ce645abf58e4be0d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://reprobaran.ru.com/

Response headers

etag
"6006842b-1ab7"
x-content-type-options
nosniff
accept-ranges
bytes
content-length
6839
x-xss-protection
1; mode=block
date
Sat, 19 Oct 2024 02:16:49 GMT
content-type
image/png
last-modified
Tue, 19 Jan 2021 07:03:07 GMT
server
nginx
x-frame-options
SAMEORIGIN
icon-teaser-magnify.svg
signin.immowelt.de/static/intermediary-iwt/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://signin.immowelt.de/static/intermediary-iwt/images/icon-teaser-magnify.svg
Requested by
Host: reprobaran.ru.com
URL: https://reprobaran.ru.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-14.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
95b6af6df04ea28daee05d78c1de48f9b386294a6a87503b9eae94d3e8ceff70

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://reprobaran.ru.com/

Response headers

etag
"4b6938455aa3d71d0405b5a67e1d5e38"
age
3189
via
1.1 2f72de1f504b6784c7adb04e7fe314f2.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
2271
x-amz-cf-id
pgVrhOfA9AeMADqJUzl-Uf69SAouhJo8V5q7QUT2dRZlBnXKkIgaGw==
date
Sat, 19 Oct 2024 01:23:41 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Mar 2024 17:27:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
x-amz-server-side-encryption
AES256
icon-teaser-arrows.svg
signin.immowelt.de/static/intermediary-iwt/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://signin.immowelt.de/static/intermediary-iwt/images/icon-teaser-arrows.svg
Requested by
Host: reprobaran.ru.com
URL: https://reprobaran.ru.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-14.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
667e25b67585a8da45125ea470976ef8ae9df1b8c9413388b32fc7a45549b632

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://reprobaran.ru.com/

Response headers

etag
"c8551e0ed6f820f4be47c4ad37c67330"
age
1244
via
1.1 2f72de1f504b6784c7adb04e7fe314f2.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
2303
x-amz-cf-id
giUrmMs5u5NSi70Xxl3JX4u_xL072B80Vva2XL93lTGzg_bWAcmyig==
date
Sat, 19 Oct 2024 01:56:06 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Mar 2024 17:27:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
x-amz-server-side-encryption
AES256
login-default-lgm.jpg
signin.immowelt.de/static/intermediary-iwt/images/ 		134 KB
134 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://signin.immowelt.de/static/intermediary-iwt/images/login-default-lgm.jpg
Requested by
Host: reprobaran.ru.com
URL: https://reprobaran.ru.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-14.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
92e88b5438d5842ae2bcbb004bee273541c983a0c2a67e6d7c9292cd7bca52f0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://reprobaran.ru.com/

Response headers

etag
"fdf5a7666c4799b920e1ada3a7578a75"
age
240
via
1.1 2f72de1f504b6784c7adb04e7fe314f2.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
136827
x-amz-cf-id
MDFO8SLuwWpkrJM6vZEyyTEof4A-RHusvSJ2qQFMH8QfK43dXuq7IQ==
date
Sat, 19 Oct 2024 02:12:50 GMT
content-type
image/jpeg
last-modified
Tue, 05 Mar 2024 17:27:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
x-amz-server-side-encryption
AES256
immoSans-Regular.woff2
smartdesign.immowelt.org/font/1.4.4/fonts/immo-sans/ 		31 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://smartdesign.immowelt.org/font/1.4.4/fonts/immo-sans/immoSans-Regular.woff2
Requested by
Host: reprobaran.ru.com
URL: https://reprobaran.ru.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-63.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9b2ae860d6d78f626fcca577ca659d5d794d1b5a4e7277f86b310de4fe4ddb4a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://reprobaran.ru.com
Referer
https://reprobaran.ru.com/

Response headers

access-control-max-age
3000
access-control-expose-headers
ETag
etag
"34d0ced28e14b1c098c03db6b6aa0560"
age
2595679
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
Me2jcAK5TYX68aD885CmhHtn_mKtqh6huA4unsycfVTJIXzennlmqQ==
date
Thu, 19 Sep 2024 01:15:30 GMT
content-type
binary/octet-stream
last-modified
Thu, 07 Oct 2021 08:04:06 GMT
vary
Access-Control-Request-Headers,Access-Control-Request-Method
cache-control
public, max-age=31536000
via
1.1 7ce1191b390045e05b9cc74f7514b77a.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
31504
x-amz-cf-pop
FRA6-C1
server
AmazonS3
favicon.ico
signin.immowelt.de/static/intermediary-iwt/images/ 		15 KB
15 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://signin.immowelt.de/static/intermediary-iwt/images/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-14.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e030aec0ead2916a959657ef45b3aaa5356e5cc7054f60653f1ff8f2192f18da

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://reprobaran.ru.com/

Response headers

etag
"d51c5a4d951041c0f3d27ccbd9615808"
age
328
via
1.1 2f72de1f504b6784c7adb04e7fe314f2.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
15086
x-amz-cf-id
156YrjZ2BAZNnPIsKDGsJ2k67VxN6KyECgjz5GcbQ58Swv9UGNkraw==
date
Sat, 19 Oct 2024 02:12:02 GMT
content-type
image/x-icon
last-modified
Tue, 05 Mar 2024 17:27:33 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P2
x-amz-server-side-encryption
AES256

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getCssVariableColor function| handleResendLink

0 Cookies