URL: https://www.50plan.payment.pdf.50plan.pro/
Submission: On September 21 via automatic, source certstream-suspicious — Scanned from ES

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 178.33.116.125, located in Spain and belongs to OVH, FR. The main domain is www.50plan.payment.pdf.50plan.pro.
TLS certificate: Issued by R11 on September 21st 2024. Valid for: 3 months.
This is the only time www.50plan.payment.pdf.50plan.pro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 178.33.116.125 16276 (OVH)
1 5.161.68.47 213230 (HETZNER-C...)
12 2
Apex Domain
Subdomains
Transfer
11 50plan.pro
www.50plan.payment.pdf.50plan.pro
301 KB
1 sitehub.io
preview.sitehub.io
3 KB
12 2
Domain Requested by
11 www.50plan.payment.pdf.50plan.pro www.50plan.payment.pdf.50plan.pro
1 preview.sitehub.io www.50plan.payment.pdf.50plan.pro
12 2

This site contains no links.

Subject Issuer Validity Valid
www.50plan.payment.pdf.50plan.pro
R11
2024-09-21 -
2024-12-20
3 months crt.sh
preset.sitehub.io
R11
2024-07-26 -
2024-10-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.50plan.payment.pdf.50plan.pro/
Frame ID: 9F89098EED6A73D2DB7A57BC4F02AB56
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

50plan.payment.pdf - Berlin

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/slick(?:\.min)?\.js

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

305 kB
Transfer

774 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.50plan.payment.pdf.50plan.pro/
4 KB
2 KB
Document
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
7eed8b510ebea349927954f3879b79550c89c56d3456cbaeb258ff8a8c4dba2e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
1345
content-security-policy
upgrade-insecure-requests;
content-type
text/html
date
Sat, 21 Sep 2024 14:17:35 GMT
last-modified
Sat, 21 Sep 2024 14:15:16 GMT
server
LiteSpeed
strict-transport-security
max-age=31536000; preload
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
app.min.1726225176.css
www.50plan.payment.pdf.50plan.pro/webcard/static/
114 KB
16 KB
Stylesheet
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/webcard/static/app.min.1726225176.css
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
57f89db8ac64c5ab191ef26950da6ccb87fec55939b63e1768e5407319ebb037
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
content-encoding
br
expires
Sat, 28 Sep 2024 14:17:35 GMT
accept-ranges
bytes
content-length
16517
date
Sat, 21 Sep 2024 14:17:35 GMT
x-xss-protection
1; mode=block
content-type
text/css
last-modified
Sat, 21 Sep 2024 14:15:16 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
custom.240921161013.css
www.50plan.payment.pdf.50plan.pro/css/
41 KB
6 KB
Stylesheet
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/css/custom.240921161013.css
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
45724cdfa62366ab24718cbfc20dbae9a4967f2de6f5cb58c7668caa8fd91c45
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
content-encoding
br
expires
Sat, 28 Sep 2024 14:17:35 GMT
accept-ranges
bytes
content-length
6155
date
Sat, 21 Sep 2024 14:17:35 GMT
x-xss-protection
1; mode=block
content-type
text/css
last-modified
Sat, 21 Sep 2024 14:15:20 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
Extranjero.png
www.50plan.payment.pdf.50plan.pro/images/1024/10921322/
68 KB
64 KB
Image
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/images/1024/10921322/Extranjero.png
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
2f03f75ef2d6e37062cbbb566770017f3b9948013362ada51fc5bf874aaf8484
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
content-encoding
br
expires
Sat, 28 Sep 2024 14:17:35 GMT
accept-ranges
bytes
content-length
65812
date
Sat, 21 Sep 2024 14:17:35 GMT
x-xss-protection
1; mode=block
content-type
image/png
last-modified
Sat, 21 Sep 2024 14:15:17 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
app.bundle.1726225181.js
www.50plan.payment.pdf.50plan.pro/webcard/static/
387 KB
111 KB
Script
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/webcard/static/app.bundle.1726225181.js
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
fb3404b5e954cbb2094822c234a6e3f3fb3fd55ad9878e477f6434b35762dace
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
content-encoding
br
accept-ranges
bytes
content-length
113832
date
Sat, 21 Sep 2024 14:17:35 GMT
x-xss-protection
1; mode=block
content-type
text/javascript
last-modified
Sat, 21 Sep 2024 14:15:20 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
custom.240921160715.js
www.50plan.payment.pdf.50plan.pro/js/
0
54 B
Script
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/js/custom.240921160715.js
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
0
date
Sat, 21 Sep 2024 14:17:36 GMT
x-xss-protection
1; mode=block
content-type
text/javascript
last-modified
Sat, 21 Sep 2024 14:15:20 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
background-image.jpg
preview.sitehub.io/images/576/2815509/
3 KB
3 KB
Image
General
Full URL
https://preview.sitehub.io/images/576/2815509/background-image.jpg
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.68.47 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
balancer-useast1.hosts.page-tech.de
Software
nginx /
Resource Hash
1b5d40a8f2ac24738b8bf07ac3445b1577ac40fc31720df161f99c126e455e3f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

cache-control
max-age=2592000
etag
"c11-5b34a976dca43"
expires
Fri, 26 Jul 2024 07:36:39 GMT
accept-ranges
bytes
content-length
3089
date
Sat, 21 Sep 2024 14:17:36 GMT
x-butlerboost
HIT
content-type
image/jpeg
last-modified
Wed, 04 Nov 2020 16:37:13 GMT
server
nginx
slick.min.js
www.50plan.payment.pdf.50plan.pro/webcard/vendor/slick/
41 KB
10 KB
Script
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/webcard/vendor/slick/slick.min.js
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/webcard/static/app.bundle.1726225181.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
b670e6d6aabf1d69ba6554d6a772984c2173572f0046cf00c2388c871279fcb8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
content-encoding
br
accept-ranges
bytes
content-length
10089
date
Sat, 21 Sep 2024 14:17:36 GMT
x-xss-protection
1; mode=block
content-type
text/javascript
last-modified
Sat, 21 Sep 2024 14:15:20 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
background-image.jpg
www.50plan.payment.pdf.50plan.pro/images/1680/2815509/
17 KB
3 KB
Image
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/images/1680/2815509/background-image.jpg
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
ec7a087bb8009c6997bb25a782752a1828409ed76f3bab77c7159f4a7cd4355e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
content-encoding
br
expires
Sat, 28 Sep 2024 14:17:36 GMT
accept-ranges
bytes
content-length
2942
date
Sat, 21 Sep 2024 14:17:36 GMT
x-xss-protection
1; mode=block
content-type
image/jpeg
last-modified
Sat, 21 Sep 2024 14:15:17 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
fontawesome-webfont.20fd1704.woff2
www.50plan.payment.pdf.50plan.pro/webcard/static/fonts/
75 KB
75 KB
Font
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/webcard/static/fonts/fontawesome-webfont.20fd1704.woff2
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/webcard/static/app.min.1726225176.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://www.50plan.payment.pdf.50plan.pro
Referer
https://www.50plan.payment.pdf.50plan.pro/webcard/static/app.min.1726225176.css

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
expires
Sat, 28 Sep 2024 14:17:36 GMT
accept-ranges
bytes
content-length
77160
date
Sat, 21 Sep 2024 14:17:36 GMT
x-xss-protection
1; mode=block
content-type
font/woff2
last-modified
Sat, 21 Sep 2024 14:15:16 GMT
server
LiteSpeed
x-frame-options
SAMEORIGIN
img-small-white.jpg
www.50plan.payment.pdf.50plan.pro/images/1024%2C849x600%2B75%2B0/2815506/
12 KB
7 KB
Image
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/images/1024%2C849x600%2B75%2B0/2815506/img-small-white.jpg
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
2493e5af1176e4b87f67d9375ac621f3564e14ee07b777edb7f6ae7188d5d45e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
content-encoding
br
expires
Sat, 28 Sep 2024 14:17:36 GMT
accept-ranges
bytes
content-length
6804
date
Sat, 21 Sep 2024 14:17:36 GMT
x-xss-protection
1; mode=block
content-type
image/jpeg
last-modified
Sat, 21 Sep 2024 14:15:19 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN
img-small-white.jpg
www.50plan.payment.pdf.50plan.pro/images/1024%2C849x600%2B75%2B0/2815503/
12 KB
7 KB
Image
General
Full URL
https://www.50plan.payment.pdf.50plan.pro/images/1024%2C849x600%2B75%2B0/2815503/img-small-white.jpg
Requested by
Host: www.50plan.payment.pdf.50plan.pro
URL: https://www.50plan.payment.pdf.50plan.pro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.33.116.125 , Spain, ASN16276 (OVH, FR),
Reverse DNS
hl127.lucushost.org
Software
LiteSpeed /
Resource Hash
2493e5af1176e4b87f67d9375ac621f3564e14ee07b777edb7f6ae7188d5d45e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://www.50plan.payment.pdf.50plan.pro/

Response headers

strict-transport-security
max-age=31536000; preload
content-security-policy
upgrade-insecure-requests;
cache-control
public, max-age=604800
content-encoding
br
expires
Sat, 28 Sep 2024 14:17:36 GMT
accept-ranges
bytes
content-length
6804
date
Sat, 21 Sep 2024 14:17:36 GMT
x-xss-protection
1; mode=block
content-type
image/jpeg
last-modified
Sat, 21 Sep 2024 14:15:19 GMT
vary
Accept-Encoding
server
LiteSpeed
x-frame-options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webcard object| webpackChunkcore_bundle object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime function| jQuery function| $ function| Class function| extendAvailable function| Importer function| Viewport function| Animations function| ElementBase function| ElementAudio function| ElementButton function| ElementContainer function| ElementDocument function| ElementFacebook function| ElementForm function| ElementGallery function| ElementGrid function| ElementHeadline function| ElementHtml function| ElementIcon function| ElementIframe function| ElementSvg function| ElementImage function| ElementLogo function| ElementMap function| ElementMenu function| ElementReference function| ElementSection function| ElementSeparator function| ElementSlider function| ElementContentSlider function| ElementSpacer function| ElementText function| ElementVideo function| ElementYoutube function| ElementVimeo function| ElementCollectionContainer function| ElementCollectionItem function| ElementPrivacy function| ElementLanguage function| ElementFormContainer function| ElementFormButton function| ElementFormCaptcha function| ElementFormCheckbox function| ElementFormInput function| ElementFormEmail function| ElementFormNumber function| ElementFormPhone function| ElementFormDate function| ElementFormRadio function| ElementFormSelect function| ElementFormTextarea function| ElementFormUpload function| ElementEcwidStore function| ElementEcwidProducts function| ElementEcwidSearch function| ElementEcwidCart function| ElementEcwidCategories object| viewport object| animations

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block