mabruesd.dyndns-server.com Open in urlscan Pro
185.194.219.170 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mabruesd.dyndns-server.com/
Submission: On January 21 via manual (January 21st 2022, 6:14:38 am UTC) from IN — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 3 domains to perform 8 HTTP transactions. The main IP is 185.194.219.170, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is mabruesd.dyndns-server.com.
TLS certificate: Issued by R3 on January 19th 2022. Valid for: 3 months.

This is the only time mabruesd.dyndns-server.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	185.194.219.170 185.194.219.170	51167 (CONTABO) (CONTABO)
4	192.243.59.12 192.243.59.12	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	46.105.201.240 46.105.201.240	16276 (OVH) (OVH)
1	192.99.8.27 192.99.8.27	16276 (OVH) (OVH)
8	4

2 185.194.219.170 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi721107.contaboserver.net

mabruesd.dyndns-server.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

departgross.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.99.8.27 (Canada)

ASN16276 (OVH, FR)
PTR: ns500876.ip-192-99-8.net

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	departgross.com departgross.com — Cisco Umbrella Rank: 743802
2	histats.com s10.histats.com — Cisco Umbrella Rank: 14234 s4.histats.com — Cisco Umbrella Rank: 12293	5 KB
2	dyndns-server.com mabruesd.dyndns-server.com	5 KB
8	3

	Domain	Requested by
4	departgross.com	mabruesd.dyndns-server.com
2	mabruesd.dyndns-server.com	mabruesd.dyndns-server.com
1	s4.histats.com	s10.histats.com
1	s10.histats.com	mabruesd.dyndns-server.com
8	4

This site contains no links.

Subject Issuer	Validity	Valid
mabruesd.dyndns-server.com R3	`2022-01-19` - `2022-04-19`	3 months	crt.sh
departgross.com R3	`2021-12-01` - `2022-03-01`	3 months	crt.sh
histats.com R3	`2021-10-27` - `2022-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mabruesd.dyndns-server.com/
Frame ID: 2E80462086BEC5612900CA253989B3C1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loginnote: Look up Login Pages By Guide Information

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

4
Countries

9 kB
Transfer

25 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response mabruesd.dyndns-server.com/	14 KB 4 KB	6572ms 39ms	Document text/html	185.194.219.170 CONTABO
General Check archive.org Show headers Download Go to Full URL https://mabruesd.dyndns-server.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.194.219.170 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS vmi721107.contaboserver.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `89f54565aa3be3822404d30c53bb76e4dee1010864a834b2cd638d6d9493591e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Fri, 21 Jan 2022 06:14:32 GMT Server Apache/2.4.29 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Content-Length 4263 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	403	5c7a495dbeea8daf77501410b72bbcad.js departgross.com/5c/7a/49/	0 0	1002ms 101ms	Script application/javascript	192.243.59.12 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://departgross.com/5c/7a/49/5c7a495dbeea8daf77501410b72bbcad.js Requested by Host: mabruesd.dyndns-server.com URL: https://mabruesd.dyndns-server.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.17.6 / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://mabruesd.dyndns-server.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers access-control-allow-origin * date Fri, 21 Jan 2022 06:14:33 GMT server nginx/1.17.6 content-type application/javascript content-length 0 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
GET H2	403	invoke.js departgross.com/ee22ef9502c06c3a21cbbd454f0b40ac/	0 0	1014ms 114ms	Script application/javascript	192.243.59.12 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://departgross.com/ee22ef9502c06c3a21cbbd454f0b40ac/invoke.js Requested by Host: mabruesd.dyndns-server.com URL: https://mabruesd.dyndns-server.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.17.6 / Resource Hash Request headers Referer https://mabruesd.dyndns-server.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers access-control-allow-origin * date Fri, 21 Jan 2022 06:14:33 GMT server nginx/1.17.6 content-type application/javascript content-length 0 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
GET H2	403	invoke.js departgross.com/f247415af06069a83c66ed9352a886ba/	0 0	111ms 111ms	Script application/javascript	192.243.59.12 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://departgross.com/f247415af06069a83c66ed9352a886ba/invoke.js Requested by Host: mabruesd.dyndns-server.com URL: https://mabruesd.dyndns-server.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.17.6 / Resource Hash Request headers Referer https://mabruesd.dyndns-server.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers access-control-allow-origin * date Fri, 21 Jan 2022 06:14:33 GMT server nginx/1.17.6 content-type application/javascript content-length 0 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
GET H/1.1	200 OK	floating.js Show response mabruesd.dyndns-server.com/assets/yozha/	0 202 B	15ms 15ms	Script text/html	185.194.219.170 CONTABO
General Check archive.org Show headers Download Go to Full URL https://mabruesd.dyndns-server.com/assets/yozha/floating.js?v=1642745673940 Requested by Host: mabruesd.dyndns-server.com URL: https://mabruesd.dyndns-server.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.194.219.170 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS vmi721107.contaboserver.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://mabruesd.dyndns-server.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Fri, 21 Jan 2022 06:14:33 GMT Server Apache/2.4.29 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 0 Content-Type text/html; charset=UTF-8
GET H2	200	js15_as.js Show response s10.histats.com/	11 KB 5 KB	67ms 9ms	Script application/javascript	46.105.201.240 OVH
General Check archive.org Show headers Download Go to Full URL https://s10.histats.com/js15_as.js Requested by Host: mabruesd.dyndns-server.com URL: https://mabruesd.dyndns-server.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 46.105.201.240 , France, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash `2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede` Request headers Accept-Language de-DE,de;q=0.9 Referer https://mabruesd.dyndns-server.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Fri, 21 Jan 2022 06:11:40 GMT content-encoding br last-modified Thu, 16 Apr 2020 10:44:16 GMT x-cdn-pop-ip 137.74.120.0/27 etag "-375139978" x-cacheable Matched cache content-type application/javascript; charset=UTF-8 x-cdn-pop sbg accept-ranges bytes content-length 4364 x-request-id 57414700
GET H2	403	5c7a495dbeea8daf77501410b72bbcad.js departgross.com/5c/7a/49/	0 0	110ms 110ms	Script application/javascript	192.243.59.12 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://departgross.com/5c/7a/49/5c7a495dbeea8daf77501410b72bbcad.js Requested by Host: mabruesd.dyndns-server.com URL: https://mabruesd.dyndns-server.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.17.6 / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://mabruesd.dyndns-server.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers access-control-allow-origin * date Fri, 21 Jan 2022 06:14:34 GMT server nginx/1.17.6 content-type application/javascript content-length 0 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
GET H/1.1	200 OK	0.php Show response s4.histats.com/stats/	50 B 184 B	299ms 96ms	Script text/html	192.99.8.27 OVH
General Check archive.org Show headers Download Go to Full URL https://s4.histats.com/stats/0.php?3598260&@f16&@g1&@h1&@i1&@j1642745674028&@k0&@l1&@mLoginnote%3A%20Look%20up%20Login%20Pages%20By%20Guide%20Information&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-90525219&@b3:1642745674&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fmabruesd.dyndns-server.com%2F&@w Requested by Host: s10.histats.com URL: https://s10.histats.com/js15_as.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.99.8.27 , Canada, ASN16276 (OVH, FR), Reverse DNS ns500876.ip-192-99-8.net Software / Resource Hash `871f8211f203eb41f9be4a2cf20a746eae6f0be79a779a977abc29d1684a7fec` Request headers Accept-Language de-DE,de;q=0.9 Referer https://mabruesd.dyndns-server.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Fri, 21 Jan 2022 06:14:34 GMT Connection close Content-Length 50 Content-Type text/html;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstCfa3598260 Value: 1642745674028
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstCla3598260 Value: 1642745674028
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstCmu3598260 Value: 1642745674028
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstPn3598260 Value: 1
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstPt3598260 Value: 1
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstCnv3598260 Value: 1
mabruesd.dyndns-server.com/	1970-01-20 09:04:41	Name: HstCns3598260 Value: 1

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://mabruesd.dyndns-server.com/(Line 28) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://departgross.com/ee22ef9502c06c3a21cbbd454f0b40ac/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://mabruesd.dyndns-server.com/(Line 28) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://departgross.com/ee22ef9502c06c3a21cbbd454f0b40ac/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://departgross.com/5c/7a/49/5c7a495dbeea8daf77501410b72bbcad.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://departgross.com/ee22ef9502c06c3a21cbbd454f0b40ac/invoke.js Message: Failed to load resource: the server responded with a status of 403 ()
javascript	warning	URL: https://mabruesd.dyndns-server.com/(Line 43) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://departgross.com/f247415af06069a83c66ed9352a886ba/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://mabruesd.dyndns-server.com/(Line 43) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://departgross.com/f247415af06069a83c66ed9352a886ba/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://departgross.com/f247415af06069a83c66ed9352a886ba/invoke.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://departgross.com/5c/7a/49/5c7a495dbeea8daf77501410b72bbcad.js Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

departgross.com
mabruesd.dyndns-server.com
s10.histats.com
s4.histats.com
185.194.219.170
192.243.59.12
192.99.8.27
46.105.201.240
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
871f8211f203eb41f9be4a2cf20a746eae6f0be79a779a977abc29d1684a7fec
89f54565aa3be3822404d30c53bb76e4dee1010864a834b2cd638d6d9493591e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

mabruesd.dyndns-server.com Open in urlscan Pro 185.194.219.170 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

4 Countries

9 kBTransfer

25 kBSize

7 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

7 Cookies

8 Console Messages

Indicators

mabruesd.dyndns-server.com Open in urlscan Pro
185.194.219.170 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

4
Countries

9 kB
Transfer

25 kB
Size

7
Cookies

8 HTTP transactions
0 data transactions