suspicious-lehmann.159-203-66-166.plesk.page

Summary

This website contacted 1 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 159.203.66.166, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is suspicious-lehmann.159-203-66-166.plesk.page.
TLS certificate: Issued by R3 on September 25th 2021. Valid for: 3 months.

This is the only time suspicious-lehmann.159-203-66-166.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	107.23.214.253 107.23.214.253	14618 (AMAZON-AES) (AMAZON-AES)
1 1	162.216.242.206 162.216.242.206	398019 (DYNU) (DYNU)
2 6	159.203.66.166 159.203.66.166	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
4	1

1 107.23.214.253 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-23-214-253.compute-1.amazonaws.com

hyperurl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.216.242.206 (United States) 1 redirects

ASN398019 (DYNU, US)
PTR: webredirect.dynu.com

mickeyncathy.accesscam.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 159.203.66.166 (Clifton, United States) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

suspicious-lehmann.159-203-66-166.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	plesk.page 2 redirects suspicious-lehmann.159-203-66-166.plesk.page	71 KB
1	accesscam.org 1 redirects mickeyncathy.accesscam.org	318 B
1	hyperurl.co 1 redirects hyperurl.co	1 KB
4	3

	Domain	Requested by
6	suspicious-lehmann.159-203-66-166.plesk.page	2 redirects suspicious-lehmann.159-203-66-166.plesk.page
1	mickeyncathy.accesscam.org	1 redirects
1	hyperurl.co	1 redirects
4	3

This site contains no links.

Subject Issuer	Validity	Valid
suspicious-lehmann.159-203-66-166.plesk.page R3	`2021-09-25` - `2021-12-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c
Frame ID: BC0DD86CB2B294705F4F00DB02F6F8C3
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Document

Page URL History Show full URLs

http://hyperurl.co/30hflg?hXXp://response.regions.com/t?r=4355 HTTP 301
http://mickeyncathy.accesscam.org/?hXXp%3A%2F%2Fresponse.regions.com%2Ft%3Fr=4355 HTTP 302
https://suspicious-lehmann.159-203-66-166.plesk.page/nyc//?hXXp%253A%252F%252Fresponse.regions.com%252Ft%253Fr=4355 HTTP 302
https://suspicious-lehmann.159-203-66-166.plesk.page/nyc//content?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&s... HTTP 301
https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&s... Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

1
IPs

1
Countries

70 kB
Transfer

147 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hyperurl.co/30hflg?hXXp://response.regions.com/t?r=4355 HTTP 301
http://mickeyncathy.accesscam.org/?hXXp%3A%2F%2Fresponse.regions.com%2Ft%3Fr=4355 HTTP 302
https://suspicious-lehmann.159-203-66-166.plesk.page/nyc//?hXXp%253A%252F%252Fresponse.regions.com%252Ft%253Fr=4355 HTTP 302
https://suspicious-lehmann.159-203-66-166.plesk.page/nyc//content?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c HTTP 301
https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/ Redirect Chain http://hyperurl.co/30hflg?hXXp://response.regions.com/t?r=4355 http://mickeyncathy.accesscam.org/?hXXp%3A%2F%2Fresponse.regions.com%2Ft%3Fr=4355 https://suspicious-lehmann.159-203-66-166.plesk.page/nyc//?hXXp%253A%252F%252Fresponse.regions.com%252Ft%253Fr=4355 https://suspicious-lehmann.159-203-66-166.plesk.page/nyc//content?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c	466 B 628 B	473ms 473ms	Document text/html	159.203.66.166 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c Protocol H2 Security TLS 1.3, , AES_256_GCM Server 159.203.66.166 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / PHP/7.4.23 PleskLin Resource Hash `c33f1d79ff8a5225bb8136d5dc85c3bd138566184a0345b41301f06ff2bbca66` Request headers :method GET :authority suspicious-lehmann.159-203-66-166.plesk.page :scheme https :path /nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Sat, 25 Sep 2021 07:42:02 GMT content-type text/html; charset=UTF-8 content-length 307 x-powered-by PHP/7.4.23 PleskLin expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie cazanova=g14j8ksspcne3m7hd5dcdjuk7o2ad6eb; expires=Sat, 25-Sep-2021 09:42:02 GMT; Max-Age=7200; path=/; HttpOnly vary Accept-Encoding content-encoding gzip Redirect headers server nginx date Sat, 25 Sep 2021 07:42:01 GMT content-type text/html; charset=iso-8859-1 content-length 481 location https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c x-powered-by PleskLin
GET H2	200	captcha.js Show response suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/assets/js/	118 KB 41 KB	405ms 405ms	Script application/javascript	159.203.66.166 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/assets/js/captcha.js Requested by Host: suspicious-lehmann.159-203-66-166.plesk.page URL: https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c Protocol H2 Security TLS 1.3, , AES_256_GCM Server 159.203.66.166 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / PleskLin Resource Hash `6f7d1dc4867c2df3a57e5ab46e45d755e11eee0abbefa53a22e56219fcd89c61` Request headers :path /nyc/content/assets/js/captcha.js pragma no-cache cookie cazanova=g14j8ksspcne3m7hd5dcdjuk7o2ad6eb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority suspicious-lehmann.159-203-66-166.plesk.page referer https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 25 Sep 2021 07:42:02 GMT content-encoding br etag W/"60d02162-1d728" last-modified Mon, 21 Jun 2021 05:19:30 GMT server nginx x-powered-by PleskLin content-type application/javascript
GET H2	200	captcha.png suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/	4 KB 4 KB	328ms 327ms	Image image/png	159.203.66.166 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/captcha.png?_1632555724603 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 159.203.66.166 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / PHP/7.4.23 PleskLin Resource Hash `02d6c189677c0bb458dbd8b851ec607e07e468371c5ac74d254e501733dea448` Request headers :path /nyc/content/captcha.png?_1632555724603 pragma no-cache cookie cazanova=g14j8ksspcne3m7hd5dcdjuk7o2ad6eb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority suspicious-lehmann.159-203-66-166.plesk.page referer https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Sat, 25 Sep 2021 07:42:04 GMT content-encoding gzip server nginx x-powered-by PHP/7.4.23 PleskLin vary Accept-Encoding content-type image/png cache-control no-store, no-cache, must-revalidate content-length 4273 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	2134651.png suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/	24 KB 25 KB	327ms 327ms	Image image/png	159.203.66.166 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/2134651.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 159.203.66.166 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / PleskLin Resource Hash `cf4231b22d68d9b7c92919f7b99d8d6a8d0d937e423ad8e41707a6c9759a22f8` Request headers :path /nyc/content/2134651.png pragma no-cache cookie cazanova=g14j8ksspcne3m7hd5dcdjuk7o2ad6eb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority suspicious-lehmann.159-203-66-166.plesk.page referer https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://suspicious-lehmann.159-203-66-166.plesk.page/nyc/content/?template=c08134fad7b31f979844f84e0342974c=Initiate&valid=true&session=ddc08134fad7b31f979844f84e0342974c User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sat, 25 Sep 2021 07:42:04 GMT last-modified Mon, 21 Jun 2021 05:19:30 GMT server nginx x-powered-by PleskLin etag "60d02162-61b8" content-type image/png accept-ranges bytes content-length 25016

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
hyperurl.co/	1970-01-19 21:39:20	Name: AWSALB Value: Dek90C/lZjXQ8lWWBdB9Tm7mhy2IRHtPRgxHlQp3kLD7+2CNAs7bTs955Qk08GCRzASQ9mJIJf0tHRU2xLjtD1hYnlbaYF783Z8j1hgQL+4qa0frmd0wFhIR/Xy5
hyperurl.co/	1970-01-23 13:05:15	Name: requester_id Value: 1441669293563011075
hyperurl.co/	1970-01-19 21:32:08	Name: last_click_30hflg Value: 1632555719162
suspicious-lehmann.159-203-66-166.plesk.page/	1970-01-19 21:29:22	Name: cazanova Value: g14j8ksspcne3m7hd5dcdjuk7o2ad6eb

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hyperurl.co
mickeyncathy.accesscam.org
suspicious-lehmann.159-203-66-166.plesk.page
107.23.214.253
159.203.66.166
162.216.242.206
02d6c189677c0bb458dbd8b851ec607e07e468371c5ac74d254e501733dea448
6f7d1dc4867c2df3a57e5ab46e45d755e11eee0abbefa53a22e56219fcd89c61
c33f1d79ff8a5225bb8136d5dc85c3bd138566184a0345b41301f06ff2bbca66
cf4231b22d68d9b7c92919f7b99d8d6a8d0d937e423ad8e41707a6c9759a22f8

suspicious-lehmann.159-203-66-166.plesk.page Open in urlscan Pro 159.203.66.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

1 IPs

1 Countries

70 kBTransfer

147 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

4 Cookies

Indicators

suspicious-lehmann.159-203-66-166.plesk.page Open in urlscan Pro
159.203.66.166 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

1
IPs

1
Countries

70 kB
Transfer

147 kB
Size

4
Cookies

4 HTTP transactions
0 data transactions