URL: https://hotelnettekoven.de/
Submission Tags: @phish_report
Submission: On November 06 via api from FI — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 5.44.111.80, located in Germany and belongs to ONE-NETWORK, DE. The main domain is hotelnettekoven.de.
TLS certificate: Issued by R10 on October 28th 2024. Valid for: 3 months.
This is the only time hotelnettekoven.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 5.44.111.80 8648 (ONE-NETWORK)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 2
Apex Domain
Subdomains
Transfer
2 sevdesk.de
my.sevdesk.de — Cisco Umbrella Rank: 865719
4 KB
1 hotelnettekoven.de
hotelnettekoven.de
1 KB
3 2
Domain Requested by
2 my.sevdesk.de hotelnettekoven.de
1 hotelnettekoven.de
3 2

This site contains links to these domains. Also see Links.

Domain
sevdesk.de
Subject Issuer Validity Valid
hotelnettekoven.de
R10
2024-10-28 -
2025-01-26
3 months crt.sh
sevdesk.de
WE1
2024-09-24 -
2024-12-23
3 months crt.sh

This page contains 1 frames:

Primary Page: https://hotelnettekoven.de/
Frame ID: B39A93C3446519530F791E520B736763
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

sevdesk | Login

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

5 kB
Transfer

23 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
hotelnettekoven.de/
4 KB
1 KB
Document
General
Full URL
https://hotelnettekoven.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.44.111.80 , Germany, ASN8648 (ONE-NETWORK, DE),
Reverse DNS
web302.dogado.net
Software
nginx /
Resource Hash
a9b7768a16aebdaf82a9a8c8fa6d61366f2d8a5886c1ff266922633c58787b5b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-length
1165
content-type
text/html; charset=UTF-8
date
Wed, 06 Nov 2024 02:17:00 GMT
server
nginx
vary
Accept-Encoding
logo.svg
my.sevdesk.de/images/
4 KB
2 KB
Image
General
Full URL
https://my.sevdesk.de/images/logo.svg
Requested by
Host: hotelnettekoven.de
URL: https://hotelnettekoven.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f36 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b0c048a1a9ece017cbcda940f32786f8188aa48a6e09962df2366d5dd44a3a3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://sevdesk.de
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://hotelnettekoven.de/

Response headers

x-robots-tag
noindex, nofollow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"672a3f24-109f"
age
37458
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 02:17:00 GMT
content-type
image/svg+xml
last-modified
Tue, 05 Nov 2024 15:52:04 GMT
vary
Accept-Encoding
strict-transport-security
max-age=63072000; includeSubDomains
content-security-policy
frame-ancestors 'self' https://sevdesk.de
cache-control
no-store
referrer-policy
no-referrer
cf-ray
8de195b268359b9e-FRA
x-xss-protection
0
server
cloudflare
favicon.ico
my.sevdesk.de/
15 KB
2 KB
Other
General
Full URL
https://my.sevdesk.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f36 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c5adbd599e6daefe3724181ceada5d388b2c3da2661e3cd9503c96ca8f77969
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://sevdesk.de
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://hotelnettekoven.de/

Response headers

x-robots-tag
noindex, nofollow
content-encoding
gzip
cf-cache-status
HIT
etag
W/"672a3f23-3aee"
age
36399
x-content-type-options
nosniff
date
Wed, 06 Nov 2024 02:17:00 GMT
content-type
image/x-icon
last-modified
Tue, 05 Nov 2024 15:52:03 GMT
vary
Accept-Encoding
strict-transport-security
max-age=63072000; includeSubDomains
content-security-policy
frame-ancestors 'self' https://sevdesk.de
cache-control
no-store
referrer-policy
no-referrer
cf-ray
8de195b2c8589b9e-FRA
x-xss-protection
0
server
cloudflare

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
.sevdesk.de/ Name: __cf_bm
Value: Br.YJpO6wGQ1z.9v7YCIIAROyuy9KKOygxeWjI4SY.I-1730859420-1.0.1.1-_qrpKzQzKws8KtByaJRwludwjG1QCJDKiukGDLWa.opcrteNy_rwPvLJg2.KlQBTeCSL4f0bKcRNxnIca4PLIQ

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://hotelnettekoven.de/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hotelnettekoven.de
my.sevdesk.de
2606:4700::6812:f36
5.44.111.80
4b0c048a1a9ece017cbcda940f32786f8188aa48a6e09962df2366d5dd44a3a3
8c5adbd599e6daefe3724181ceada5d388b2c3da2661e3cd9503c96ca8f77969
a9b7768a16aebdaf82a9a8c8fa6d61366f2d8a5886c1ff266922633c58787b5b