axstrum.bplaced.net Open in urlscan Pro
144.76.167.70 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://axstrum.bplaced.net/sect/admin/
Submission: On December 08 via automatic, source phishtank (December 8th 2017, 6:39:25 pm UTC)

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 144.76.167.70, located in Germany and belongs to HETZNER-AS, DE. The main domain is axstrum.bplaced.net.

This is the only time axstrum.bplaced.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
4 13	144.76.167.70 144.76.167.70	24940 (HETZNER-AS) (HETZNER-AS)
4	2a01:4f8:162:... 2a01:4f8:162:4306::2	24940 (HETZNER-AS) (HETZNER-AS)
13	2

13 144.76.167.70 (Germany) 4 redirects

ASN24940 (HETZNER-AS, DE)
PTR: server2.bplaced.net

axstrum.bplaced.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a01:4f8:162:4306::2 (Germany)

ASN24940 (HETZNER-AS, DE)

www.bplaced.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	bplaced.net 4 redirects axstrum.bplaced.net www.bplaced.net	30 KB
13	1

	Domain	Requested by
13	axstrum.bplaced.net	4 redirects axstrum.bplaced.net
4	www.bplaced.net	axstrum.bplaced.net
13	2

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://axstrum.bplaced.net/sect/admin/
Frame ID: (5492987D855AA7DD57BFDB35EA533AB)
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

13
Requests

0 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

30 kB
Transfer

82 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://go.microsoft.com/fwlink/?LinkID=129362
Title: click here.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

http://axstrum.bplaced.net/sect/admin/index_files/lgntopm.gif HTTP 302
http://www.bplaced.net/404

Request Chain 9

http://axstrum.bplaced.net/sect/admin/index_files/lgnleft.gif HTTP 302
http://www.bplaced.net/404

Request Chain 10

http://axstrum.bplaced.net/sect/admin/index_files/lgnright.gif HTTP 302
http://www.bplaced.net/404

Request Chain 11

http://axstrum.bplaced.net/sect/admin/index_files/lgnbotm.gif HTTP 302
http://www.bplaced.net/404

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
axstrum.bplaced.net/sect/admin/ 9 KB
0 19ms
18ms Document
text/html 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: a672a0a4d496d0ed96c581d854d3ca90ccb70f31d4af5a81dd7a0d2c77d82213

Request headers

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection: keep-alive
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 31 Oct 2017 16:45:58 GMT
Server: Apache/2.4
ETag: "24a9-55cda7d528dc8-gzip"
Vary: Accept-Encoding
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Content-Length: 3045

GET
H/1.1 200
OK logon.css
axstrum.bplaced.net/sect/admin/index_files/ 2 KB
891 B 17ms
16ms Stylesheet
text/css 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 31 Oct 2017 16:46:21 GMT
Server: Apache/2.4
ETag: "9d9-55cda7eb450ec-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 891

GET
H/1.1 200
OK owafont.css
axstrum.bplaced.net/sect/admin/index_files/ 5 KB
2 KB 26ms
25ms Stylesheet
text/css 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/owafont.css
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: 5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 31 Oct 2017 16:46:24 GMT
Server: Apache/2.4
ETag: "12d6-55cda7edfe541-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 1571

GET
H/1.1 200
OK flogon.js Show response
axstrum.bplaced.net/sect/admin/index_files/ 4 KB
2 KB 28ms
27ms Script
application/javascript 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/flogon.js
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: 808c144b550309d5e4bf04c7d433deeb93a0c7070ac3ff904c4b297fabe24cb1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
Last-Modified: Tue, 31 Oct 2017 16:46:01 GMT
Server: Apache/2.4
ETag: "1065-55cda7d819cbe-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 1658

GET
H/1.1 200
OK lgntopl.gif
axstrum.bplaced.net/sect/admin/index_files/ 4 KB
4 KB 7ms
6ms Image
image/gif 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/lgntopl.gif
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Last-Modified: Tue, 31 Oct 2017 16:46:17 GMT
Server: Apache/2.4
ETag: "1167-55cda7e6f588c"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 4455

GET
H/1.1 200
OK lgntopr.gif
axstrum.bplaced.net/sect/admin/index_files/ 581 B
581 B 26ms
25ms Image
image/gif 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/lgntopr.gif
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Last-Modified: Tue, 31 Oct 2017 16:46:19 GMT
Server: Apache/2.4
ETag: "245-55cda7e9251bd"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 581

GET
H/1.1 200
OK lgnexlogo.gif
axstrum.bplaced.net/sect/admin/index_files/ 61 B
61 B 11ms
10ms Image
image/gif 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/lgnexlogo.gif
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Last-Modified: Tue, 31 Oct 2017 16:46:14 GMT
Server: Apache/2.4
ETag: "3d-55cda7e3f3056"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 61

GET
H/1.1 200
OK lgnbotl.gif
axstrum.bplaced.net/sect/admin/index_files/ 9 KB
9 KB 11ms
11ms Image
image/gif 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/lgnbotl.gif
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: 0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Last-Modified: Tue, 31 Oct 2017 16:46:06 GMT
Server: Apache/2.4
ETag: "245f-55cda7dc9b1ff"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 9311

GET
H/1.1 200
OK lgnbotr.gif
axstrum.bplaced.net/sect/admin/index_files/ 2 KB
2 KB 63ms
63ms Image
image/gif 144.76.167.70
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://axstrum.bplaced.net/sect/admin/index_files/lgnbotr.gif
Requested by: Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/
Protocol: HTTP/1.1
Server: 144.76.167.70 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: server2.bplaced.net
Software: Apache/2.4 /
Resource Hash: 97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: axstrum.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Last-Modified: Tue, 31 Oct 2017 16:46:10 GMT
Server: Apache/2.4
ETag: "958-55cda7e0d911f"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 2392

GET
H/1.1

200
OK

404
www.bplaced.net/
Redirect Chain

http://axstrum.bplaced.net/sect/admin/index_files/lgntopm.gif
http://www.bplaced.net/404

11 KB
1022 B

5ms
2ms

Image
text/html

2a01:4f8:162:4306::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bplaced.net/404

Requested by

Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/

Protocol

HTTP/1.1

Server

2a01:4f8:162:4306::2 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-BP-NSA-REQID: (null) a.14UID=841
Last-Modified: Wed, 22 Nov 2017 10:29:32 GMT
Server: Apache
ETag: "2d28-55e8fcb8e7b00-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html
Keep-Alive: timeout=4, max=500
Content-Length: 4655

Redirect headers

Location: http://www.bplaced.net/404
Date: Fri, 08 Dec 2017 18:39:15 GMT
Server: Apache/2.4
Connection: close
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

404
www.bplaced.net/
Redirect Chain

http://axstrum.bplaced.net/sect/admin/index_files/lgnleft.gif
http://www.bplaced.net/404

11 KB
4 KB

2ms
1ms

Image
text/html

2a01:4f8:162:4306::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bplaced.net/404

Requested by

Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/

Protocol

HTTP/1.1

Server

2a01:4f8:162:4306::2 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-BP-NSA-REQID: (null) a.14UID=896
Last-Modified: Wed, 22 Nov 2017 10:29:32 GMT
Server: Apache
ETag: "2d28-55e8fcb8e7b00-gzip"
Vary: Accept-Encoding
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=4, max=499
Content-Length: 4655

Redirect headers

Location: http://www.bplaced.net/404
Date: Fri, 08 Dec 2017 18:39:15 GMT
Server: Apache/2.4
Connection: close
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

404
www.bplaced.net/
Redirect Chain

http://axstrum.bplaced.net/sect/admin/index_files/lgnright.gif
http://www.bplaced.net/404

11 KB
4 KB

3ms
3ms

Image
text/html

2a01:4f8:162:4306::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bplaced.net/404

Requested by

Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/

Protocol

HTTP/1.1

Server

2a01:4f8:162:4306::2 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-BP-NSA-REQID: (null) a.14UID=868
Last-Modified: Wed, 22 Nov 2017 10:29:32 GMT
Server: Apache
ETag: "2d28-55e8fcb8e7b00-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html
Keep-Alive: timeout=4, max=500
Content-Length: 4655

Redirect headers

Location: http://www.bplaced.net/404
Date: Fri, 08 Dec 2017 18:39:15 GMT
Server: Apache/2.4
Connection: close
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

404
www.bplaced.net/
Redirect Chain

http://axstrum.bplaced.net/sect/admin/index_files/lgnbotm.gif
http://www.bplaced.net/404

11 KB
1 KB

2ms
2ms

Image
text/html

2a01:4f8:162:4306::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.bplaced.net/404

Requested by

Host: axstrum.bplaced.net
URL: http://axstrum.bplaced.net/sect/admin/

Protocol

HTTP/1.1

Server

2a01:4f8:162:4306::2 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.bplaced.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://axstrum.bplaced.net/sect/admin/index_files/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Fri, 08 Dec 2017 18:39:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-BP-NSA-REQID: (null) a.14UID=865
Last-Modified: Wed, 22 Nov 2017 10:29:32 GMT
Server: Apache
ETag: "2d28-55e8fcb8e7b00-gzip"
Vary: Accept-Encoding
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=4, max=498
Content-Length: 4655

Redirect headers

Location: http://www.bplaced.net/404
Date: Fri, 08 Dec 2017 18:39:15 GMT
Server: Apache/2.4
Connection: close
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			axstrum.bplaced.net/sect/admin	1970-01-01 00:00:00	Name: cookieTest Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

axstrum.bplaced.net
www.bplaced.net
144.76.167.70
2a01:4f8:162:4306::2
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
808c144b550309d5e4bf04c7d433deeb93a0c7070ac3ff904c4b297fabe24cb1
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
a672a0a4d496d0ed96c581d854d3ca90ccb70f31d4af5a81dd7a0d2c77d82213
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

axstrum.bplaced.net Open in urlscan Pro 144.76.167.70 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

0 %HTTPS

50 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

30 kBTransfer

82 kBSize

1 Cookies

1 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

Indicators

axstrum.bplaced.net Open in urlscan Pro
144.76.167.70 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

0 %
HTTPS

50 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

30 kB
Transfer

82 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!