URL: http://lesen-hoeren-wissen.de/
Submission Tags: @phish_report
Submission: On October 25 via api from FI — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 2001:8d8:100f:f000::23d, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is lesen-hoeren-wissen.de.
This is the only time lesen-hoeren-wissen.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2001:8d8:100f... 8560 (IONOS-AS ...)
1 2a02:cb40:200... 20546 (SOPRADO-ANY)
2 2
Domain Requested by
1 stadtbibliothek.heilbronn.de lesen-hoeren-wissen.de
1 lesen-hoeren-wissen.de
2 2

This site contains no links.

Subject Issuer Validity Valid
*.heilbronn.de
R3
2023-10-09 -
2024-01-07
3 months crt.sh

This page contains 2 frames:

Primary Page: http://lesen-hoeren-wissen.de/
Frame ID: A9E90D606C67B23E2C6A14833980604C
Requests: 1 HTTP requests in this frame

Frame: https://stadtbibliothek.heilbronn.de/ueber-uns/freundeskreis.html
Frame ID: 353A6E710D361C1660B4834A070F612C
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Förderverein der Stadtbibliothek Heilbronn

Page Statistics

2
Requests

50 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1 kB
Transfer

1 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
lesen-hoeren-wissen.de/
963 B
648 B
Document
General
Full URL
http://lesen-hoeren-wissen.de/
Protocol
HTTP/1.1
Server
2001:8d8:100f:f000::23d , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
c4a068533afdfb0c859e4386fa1d23cb5c20fb5d51331106a8d317fde2352ee7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Wed, 25 Oct 2023 21:51:09 GMT
Keep-Alive
timeout=15
Server
Apache
Transfer-Encoding
chunked
freundeskreis.html
stadtbibliothek.heilbronn.de/ueber-uns/ Frame 353A
0
0
Document
General
Full URL
https://stadtbibliothek.heilbronn.de/ueber-uns/freundeskreis.html
Requested by
Host: lesen-hoeren-wissen.de
URL: http://lesen-hoeren-wissen.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:cb40:200::1f4 , Germany, ASN20546 (SOPRADO-ANY, DE),
Reverse DNS
Software
myracloud /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://lesen-hoeren-wissen.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0
content-encoding
gzip
content-language
de
content-length
8841
content-type
text/html; charset=utf-8
date
Wed, 25 Oct 2023 21:51:10 GMT
etag
"myra-abd08819"
expires
Wed, 25 Oct 2023 21:51:10 GMT
referrer-policy
origin-when-cross-origin
server
myracloud
strict-transport-security
max-age=31536000; includeSubDomains
vary
accept-encoding
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=edge
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

1 Console Messages

Source Level URL
Text
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://stadtbibliothek.heilbronn.de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lesen-hoeren-wissen.de
stadtbibliothek.heilbronn.de
2001:8d8:100f:f000::23d
2a02:cb40:200::1f4
c4a068533afdfb0c859e4386fa1d23cb5c20fb5d51331106a8d317fde2352ee7