baumeisterarchitects.com Open in urlscan Pro
199.204.248.174  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.html Show response baumeisterarchitects.com/Onedotcom/	16 KB 16 KB	1538ms 301ms	Document text/html	199.204.248.174 WEBINT
General Check archive.org Show headers Download Go to Full URL https://baumeisterarchitects.com/Onedotcom/login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.204.248.174 , United States, ASN11989 (WEBINT, US), Reverse DNS cp38.machighway.com Software Apache / Resource Hash bf68f4d31fc56e1c89957c901600dcbdf4236c537198f911f7f6aea1064571b7 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 16646 Content-Type text/html Date Mon, 18 Mar 2024 03:25:28 GMT Keep-Alive timeout=5, max=100 Last-Modified Sun, 17 Mar 2024 23:52:23 GMT Server Apache
GET H/1.1	200 OK	login.css account.one.com/auth/resources/v97oh/login/one/css/	19 KB 5 KB	1372ms 418ms	Stylesheet text/css	46.30.211.45 ONECOM
General Check archive.org Show headers Download Go to Full URL https://account.one.com/auth/resources/v97oh/login/one/css/login.css Requested by Host: baumeisterarchitects.com URL: https://baumeisterarchitects.com/Onedotcom/login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 46.30.211.45 Copenhagen, Denmark, ASN51468 (ONECOM, DK), Reverse DNS account.one.com Software nginx/1.18.0 (Ubuntu) / Resource Hash fb9df1b3aebff8ea24dfac9ec4e248f1f58aeeb7e8b0049afe1e20ae2fb8d90d Request headers accept-language en-AU,en;q=0.9 Referer https://baumeisterarchitects.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Date Mon, 18 Mar 2024 03:24:34 GMT Cache-Control max-age=2592000 Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/css;charset=UTF-8
GET H2	200	css fonts.googleapis.com/	5 KB 1 KB	564ms 190ms	Stylesheet text/css	142.251.175.95 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Montserrat:400,500,600&display=swap Requested by Host: account.one.com URL: https://account.one.com/auth/resources/v97oh/login/one/css/login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.175.95 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS sh-in-f95.1e100.net Software ESF / Resource Hash ea7c4a438cef51330307f7c15aa17efdc2797e843cb9bde47559a5eda41c34fa Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://account.one.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 18 Mar 2024 03:24:35 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 18 Mar 2024 03:24:35 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 18 Mar 2024 03:24:35 GMT
GET H2	200	one.com.b70a2250.svg login-static.cdn-one.com/v8.1.0/media/	3 KB 2 KB	2859ms 1192ms	Image image/svg+xml	195.47.247.13 ONECOM
General Check archive.org Show headers Download Go to Show image Full URL https://login-static.cdn-one.com/v8.1.0/media/one.com.b70a2250.svg Requested by Host: account.one.com URL: https://account.one.com/auth/resources/v97oh/login/one/css/login.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.47.247.13 -, , ASN51468 (ONECOM, DK), Reverse DNS static.cdn-one.com Software nginx/1.18.0 (Ubuntu) / Resource Hash 0cdb7effe1b70a6969a1ee136d5b79b235307f0242427a43a4334faa723b67b2 Security Headers Name Value Strict-Transport-Security max-age=15778800 Request headers accept-language en-AU,en;q=0.9 Referer https://account.one.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 23 Feb 2024 09:27:46 GMT content-encoding gzip via 1.1 webcache1-lon1 (Varnish/trunk) strict-transport-security max-age=15778800 age 2051811 x-node webproxy1.cst.cdnpod2-cph3.one.com content-length 1274 last-modified Mon, 24 Aug 2020 13:59:49 GMT server nginx/1.18.0 (Ubuntu) etag W/"5f43c7d5-b66" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-varnish 13287785381 4489259 cache-control max-age=315360000, public, immutable accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	cp.c1266867.jpg login-static.cdn-one.com/v8.1.0/media/	171 KB 171 KB	2272ms 606ms	Image image/jpeg	195.47.247.13 ONECOM
General Check archive.org Show headers Download Go to Show image Full URL https://login-static.cdn-one.com/v8.1.0/media/cp.c1266867.jpg Requested by Host: account.one.com URL: https://account.one.com/auth/resources/v97oh/login/one/css/login.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.47.247.13 -, , ASN51468 (ONECOM, DK), Reverse DNS static.cdn-one.com Software nginx/1.18.0 (Ubuntu) / Resource Hash e6cb5bd66f9b89bf087dca8fc573ec1d652d3603f1b35165ce40d5964310d7c2 Security Headers Name Value Strict-Transport-Security max-age=15778800 Request headers accept-language en-AU,en;q=0.9 Referer https://account.one.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 23 Feb 2024 09:27:46 GMT via 1.1 webcache1-lon1 (Varnish/trunk) strict-transport-security max-age=15778800 last-modified Mon, 24 Aug 2020 13:59:49 GMT server nginx/1.18.0 (Ubuntu) age 2051811 etag "5f43c7d5-2aa06" content-type image/jpeg access-control-allow-origin * x-varnish 13287785380 6619184 cache-control max-age=315360000, public, immutable accept-ranges bytes content-length 174598 x-node webproxy1.cst.cdnpod2-cph3.one.com expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 fonts.gstatic.com/s/montserrat/v26/	32 KB 33 KB	561ms 186ms	Font font/woff2	74.125.130.94 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:400,500,600&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.125.130.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS sb-in-f94.1e100.net Software sffe / Resource Hash bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://baumeisterarchitects.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 13 Mar 2024 17:59:43 GMT x-content-type-options nosniff age 379492 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33092 x-xss-protection 0 last-modified Wed, 13 Sep 2023 22:51:58 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 13 Mar 2025 17:59:43 GMT
GET H2	200	bc-v4.min.html Show response consentcdn.cookiebot.com/sdk/ Frame 7454	627 B 815 B	1163ms 384ms	Document text/html	23.58.46.175 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://consentcdn.cookiebot.com/sdk/bc-v4.min.html Requested by Host: baumeisterarchitects.com URL: https://baumeisterarchitects.com/Onedotcom/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.58.46.175 Chennai, India, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-58-46-175.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104 Request headers Referer https://baumeisterarchitects.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers accept-ranges bytes cache-control max-age=29903467 content-encoding gzip content-length 392 content-type text/html cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Mon, 18 Mar 2024 03:24:36 GMT etag "3d08665fa4c7bcf9fa2dcbbc7efe1d0f:1649057029.895163" expires Thu, 27 Feb 2025 05:55:43 GMT last-modified Mon, 04 Apr 2022 07:23:49 GMT server AkamaiNetStorage server-timing cdn-cache; desc=HIT edge; dur=1 ak_p; desc="1710732276050_387987807_283676525_52_1249_288_385_255";dur=1 vary Accept-Encoding x-akamai-transformed 9 - 0 pmb=mRUM,1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: one.com (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 undefined| len object| gdSearchInput function| showCookieBanner function| hideCookieBanner function| tooglePrefs function| cookieOverview number| cookieBannerSliderPos

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.one.com
baumeisterarchitects.com
consentcdn.cookiebot.com
fonts.googleapis.com
fonts.gstatic.com
login-static.cdn-one.com
142.251.175.95
195.47.247.13
199.204.248.174
23.58.46.175
46.30.211.45
74.125.130.94
0cdb7effe1b70a6969a1ee136d5b79b235307f0242427a43a4334faa723b67b2
738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bf68f4d31fc56e1c89957c901600dcbdf4236c537198f911f7f6aea1064571b7
e6cb5bd66f9b89bf087dca8fc573ec1d652d3603f1b35165ce40d5964310d7c2
ea7c4a438cef51330307f7c15aa17efdc2797e843cb9bde47559a5eda41c34fa
fb9df1b3aebff8ea24dfac9ec4e248f1f58aeeb7e8b0049afe1e20ae2fb8d90d