ernst-elektro.com Open in urlscan Pro
212.53.128.89  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request continue.php Show response ernst-elektro.com/apz2/	17 KB 17 KB	184ms 89ms	Document text/html	212.53.128.89 ARTFILES-AS Zirku...
General Check archive.org Show headers Download Go to Full URL https://ernst-elektro.com/apz2/continue.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.53.128.89 , Germany, ASN8893 (ARTFILES-AS Zirkusweg 1, DE), Reverse DNS www67.c.artfiles.de Software Apache / PHP/7.3.23 Resource Hash 7574e454774191ab96f83c52ce707167080f913938d72745bcfa5ff770f713d9 Request headers Host ernst-elektro.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 14 Nov 2020 01:57:12 GMT Server Apache X-Powered-By PHP/7.3.23 Keep-Alive timeout=3, max=50 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 803 B	36ms 16ms	Script application/javascript	2a00:1450:4001:803::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=login.libero.it Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	osd.js Show response www.nicrodur.pt/nicrodur/data/	72 KB 27 KB	411ms 134ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/osd.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 342bfc1d5d8fc1b4637a3852b595fe935f9f9f7007e5c95a619eb78f7a797ad6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:36:48 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	cmp2.js Show response www.nicrodur.pt/nicrodur/data/	256 KB 70 KB	82ms 81ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/cmp2.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 02357bfdb4bb800c7db17824516ebe9fc7c7e153a93f94cc97407ea5bb08a7b9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:12:08 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	nlsSDK600.bundle.min.js Show response www.nicrodur.pt/nicrodur/data/	170 KB 49 KB	133ms 133ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/nlsSDK600.bundle.min.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 8ff1250168ba4cf1dd53cfafb0e6fa6f3ef44c195d4039fa6bcce0c2cfaaa7bf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:12:40 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	PB842EDC3-BDDA-4494-9CDE-8B0150370A55.js Show response www.nicrodur.pt/nicrodur/data/	28 KB 7 KB	127ms 125ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/PB842EDC3-BDDA-4494-9CDE-8B0150370A55.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 74f2487b8cc78c9d6c359657010ec1b6947da19ac9feca5818fd8847262c3a2d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:13:10 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	53 KB 18 KB	35ms 14ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 06a79a26274c60253bdb0a153a7a2f1d60e9b0fec21dd9ceb9a1187c3ba5a3cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "693 / 904 of 1000 / last-modified: 1605309537" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 18109 x-xss-protection 0 expires Sat, 14 Nov 2020 01:57:13 GMT
GET H2	200	choice.js Show response www.nicrodur.pt/nicrodur/data/	5 KB 2 KB	127ms 125ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/choice.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash b8e01906baa839abb9828e7f0161991e061aae10af66fe91f9bb48539f7f404a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:13:58 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	style.css www.nicrodur.pt/nicrodur/data/	26 KB 5 KB	352ms 75ms	Stylesheet text/css	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/style.css Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash a199fa64874f1381e59e5cf78db05d9137d21272bbceeeebda0b87f2d2328645 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 14:05:32 GMT server nginx vary Accept-Encoding content-type text/css status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	jquery.min.js Show response www.nicrodur.pt/nicrodur/data/	86 KB 30 KB	464ms 187ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/jquery.min.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 12:47:10 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	placeholders.min.js Show response www.nicrodur.pt/nicrodur/data/	4 KB 2 KB	468ms 191ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/placeholders.min.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash bb631cb41d70ab6f8a07ab80b053676bca8589e7e1d835827f30e1bffbed91c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 12:47:34 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	qciol.min.js Show response www.nicrodur.pt/nicrodur/data/	7 KB 3 KB	127ms 126ms	Script application/javascript	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Full URL https://www.nicrodur.pt/nicrodur/data/qciol.min.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash f6529ad8d18b0e4eb1e3a4d67404040a8cf88e0833751b3c1fb920fbef862e72 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:18:20 GMT server nginx vary Accept-Encoding content-type application/javascript status 200 expires Mon, 14 Dec 2020 01:57:13 GMT cache-control max-age=2592000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	pubads_impl_2020100701.js Show response securepubads.g.doubleclick.net/gpt/	272 KB 96 KB	180ms 81ms	Script text/javascript	216.58.207.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020100701.js Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s25-in-f2.1e100.net Software sffe / Resource Hash 4d89fe878915363fb946ed51bc60593e90df39059bc1a05c717a0cd9ba5bf58d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 97676 x-xss-protection 0 last-modified Wed, 07 Oct 2020 08:44:07 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 14 Nov 2020 01:57:13 GMT
GET H/1.1	200 OK	iolobj-rc-write.js Show response geoisp.virgilio.it/ioladv/	780 B 792 B	235ms 53ms	Script application/javascript	213.209.16.12 MATRIX-AS
General Check archive.org Show headers Download Go to Full URL https://geoisp.virgilio.it/ioladv/iolobj-rc-write.js?tm=1602538402450&g=[undefined]g&d=[virgilio.it]d Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 213.209.16.12 Assago, Italy, ASN8660 (MATRIX-AS, IT), Reverse DNS Software Apache / Resource Hash 0c815b93cf68fc9a234ec06fc29143fb1f7ee2c5147ee9b1ae96bc27aa86fe67 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 14 Nov 2020 01:57:13 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3P policyref=http://up.ioladv.it/ioladv/policy/p3p.xml, CP=NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT CNT cache-control public, max-age=7200 Connection Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=2, max=100 Content-Length 278
GET H2	200	AdvContent20x20.png i.plug.it/banners/img/	537 B 915 B	115ms 32ms	Image image/png	143.204.215.96 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://i.plug.it/banners/img/AdvContent20x20.png Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.96 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-96.fra53.r.cloudfront.net Software nginx / Resource Hash 68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 13 Nov 2020 18:32:35 GMT via 1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront) last-modified Tue, 09 Jun 2020 08:23:45 GMT server nginx age 26678 etag "5edf4711-219" x-cache Hit from cloudfront content-type image/png status 200 cache-control max-age=1200, public x-amz-cf-pop FRA53-C1 accept-ranges bytes content-length 537 x-amz-cf-id 8ZiwMHjEMN4wJnK-P7YXTbloxFnwixjUnw5vNiQCK8CpRlTUH-nu0A== expires Fri, 13 Nov 2020 18:52:35 GMT
GET H2	200	logo-buonissimo.png i.plug.it//mail/login/2018/libero/img/	2 KB 2 KB	115ms 32ms	Image image/png	143.204.215.96 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://i.plug.it//mail/login/2018/libero/img/logo-buonissimo.png Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.215.96 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-96.fra53.r.cloudfront.net Software nginx / Resource Hash 8e3a630ecfe1d23952f3ac549e3d56ad3a7252c71a07681218da2726d8247cc2 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 13 Nov 2020 19:30:13 GMT via 1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront) last-modified Wed, 28 Nov 2018 07:13:19 GMT server nginx age 23220 etag "5bfe400f-653" x-cache Hit from cloudfront content-type image/png status 200 cache-control public, max-age=86400 x-amz-cf-pop FRA53-C1 accept-ranges bytes content-length 1619 x-amz-cf-id phSEyuHXZLX9Fd4vN-05vBeumlr_hNQQaPA6uXN54YNmbpsVUUczHw==
GET H2	200	css2 fonts.googleapis.com/	7 KB 836 B	17ms 17ms	Stylesheet text/css	2a00:1450:4001:806::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap Requested by Host: www.nicrodur.pt URL: https://www.nicrodur.pt/nicrodur/data/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4cc403707255292b5dba9340fe9b87aa43f5f7f0569784aa7a7f9dc0579894f8 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.nicrodur.pt/nicrodur/data/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 14 Nov 2020 01:57:13 GMT server ESF date Sat, 14 Nov 2020 01:57:13 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 14 Nov 2020 01:57:13 GMT
GET H2	200	container.html 48adf6763e4880c532a1c82165799574.safeframe.googlesyndication.com/safeframe/1-0-37/html/	0 0	42ms 6ms	Other text/html	2a00:1450:4001:802::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://48adf6763e4880c532a1c82165799574.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	27ms 6ms	Other text/html	2a00:1450:4001:806::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	5920802943190456062.jpg www.nicrodur.pt/nicrodur/data/	228 KB 228 KB	134ms 133ms	Image image/jpeg	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Show image Full URL https://www.nicrodur.pt/nicrodur/data/5920802943190456062.jpg Requested by Host: ernst-elektro.com URL: https://ernst-elektro.com/apz2/continue.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 8c6c23942030a75d03b7e7508467805fed6f67cafdc5842ce4da1efd01bfdc57 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:38:10 GMT server nginx content-type image/jpeg status 200 expires Wed, 13 Jan 2021 01:57:13 GMT cache-control max-age=5184000 x-server-powered-by Engintron accept-ranges bytes content-length 233433 x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	200	logo.svg www.nicrodur.pt/nicrodur/data/	5 KB 1 KB	144ms 144ms	Image image/svg+xml	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Show image Full URL https://www.nicrodur.pt/nicrodur/data/logo.svg Requested by Host: www.nicrodur.pt URL: https://www.nicrodur.pt/nicrodur/data/style.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software nginx / Resource Hash 54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.nicrodur.pt/nicrodur/data/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 12 Oct 2020 13:51:48 GMT server nginx vary Accept-Encoding content-type image/svg+xml status 200 expires Wed, 13 Jan 2021 01:57:13 GMT cache-control max-age=5184000 x-server-powered-by Engintron x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE
GET H2	404	eye-slash-regular.svg www.nicrodur.pt/nicrodur/data/img/	0 0	144ms 144ms	Image text/html	185.31.159.147 ONI Lisbon
General Check archive.org Show headers Download Go to Show image Full URL https://www.nicrodur.pt/nicrodur/data/img/eye-slash-regular.svg Requested by Host: www.nicrodur.pt URL: https://www.nicrodur.pt/nicrodur/data/style.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.31.159.147 , Portugal, ASN9186 (ONI Lisbon, Portugal., PT), Reverse DNS cloud.niceconnect.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.nicrodur.pt/nicrodur/data/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://ernst-elektro.com Referer https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 08 Nov 2020 11:20:35 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 484598 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Mon, 08 Nov 2021 11:20:35 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://ernst-elektro.com Referer https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 08 Nov 2020 11:20:35 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 484598 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Mon, 08 Nov 2021 11:20:35 GMT
GET H2	200	pubads_impl_2020111001.js Show response securepubads.g.doubleclick.net/gpt/	276 KB 98 KB	78ms 53ms	Script text/javascript	216.58.207.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111001.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s25-in-f2.1e100.net Software sffe / Resource Hash f1b23a6200bdb4728ad055b6439a7055e73c62e61a97804fa6ac13871164c198 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:57:13 GMT content-encoding gzip x-content-type-options nosniff status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 99726 x-xss-protection 0 last-modified Tue, 10 Nov 2020 09:44:01 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 14 Nov 2020 01:57:13 GMT
GET H2	200	cmp2.js Show response quantcast.mgr.consensu.org/tcfv2/	266 KB 67 KB	95ms 34ms	Script text/javascript	2600:9000:20ae:d200:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/tcfv2/cmp2.js Requested by Host: www.nicrodur.pt URL: https://www.nicrodur.pt/nicrodur/data/choice.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20ae:d200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash d60a01e86a6701bf5d527ff6b176b7b501fc2638b5582fe22be89dabf5133720 Request headers Referer https://ernst-elektro.com/apz2/continue.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 14 Nov 2020 01:56:21 GMT content-encoding br age 78 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront status 200 last-modified Fri, 13 Nov 2020 00:49:15 GMT server AmazonS3 etag "8e6f2132b0d4913d00a9957b268f90d9" vary Accept-Encoding content-type text/javascript;charset=UTF-8 via 1.1 4cb16ea6a84fa64395352e03f53b5e8f.cloudfront.net (CloudFront) cache-control max-age=3600 x-amz-meta-qc-ineu True x-amz-cf-pop WAW50-C1 x-amz-cf-id 1QP1fShxDfzDXz3LWIXKk2yQG05wNrkSI1OpirOvOacp_dKzygWgVA==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Libero (Online)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| google_js_reporting_queue object| ggeac function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| $ function| jQuery object| Placeholders object| IOLOBJ function| Fingerprint object| fp4 function| checkparams function| showMpu object| googletag object| regeneratorRuntime function| __tcfapiui function| _typeof object| NOLBUNDLE object| ns object| paramsPassed object| stateObject string| BUILDVERSION object| stateEvents function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| __google_ad_urls function| google_osd_amcb

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.nicrodur.pt/nicrodur/data/qciol.min.js(Line 97) Message: *** IOLCMP: 2.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

48adf6763e4880c532a1c82165799574.safeframe.googlesyndication.com
adservice.google.com
ernst-elektro.com
fonts.googleapis.com
fonts.gstatic.com
geoisp.virgilio.it
i.plug.it
quantcast.mgr.consensu.org
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
www.nicrodur.pt
143.204.215.96
185.31.159.147
212.53.128.89
213.209.16.12
216.58.207.66
2600:9000:20ae:d200:9:46dc:4700:93a1
2a00:1450:4001:802::2001
2a00:1450:4001:803::2002
2a00:1450:4001:806::2001
2a00:1450:4001:806::200a
2a00:1450:4001:816::2002
2a00:1450:4001:81c::2003
02357bfdb4bb800c7db17824516ebe9fc7c7e153a93f94cc97407ea5bb08a7b9
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06a79a26274c60253bdb0a153a7a2f1d60e9b0fec21dd9ceb9a1187c3ba5a3cd
0c815b93cf68fc9a234ec06fc29143fb1f7ee2c5147ee9b1ae96bc27aa86fe67
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
342bfc1d5d8fc1b4637a3852b595fe935f9f9f7007e5c95a619eb78f7a797ad6
4cc403707255292b5dba9340fe9b87aa43f5f7f0569784aa7a7f9dc0579894f8
4d89fe878915363fb946ed51bc60593e90df39059bc1a05c717a0cd9ba5bf58d
54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c
74f2487b8cc78c9d6c359657010ec1b6947da19ac9feca5818fd8847262c3a2d
7574e454774191ab96f83c52ce707167080f913938d72745bcfa5ff770f713d9
8c6c23942030a75d03b7e7508467805fed6f67cafdc5842ce4da1efd01bfdc57
8e3a630ecfe1d23952f3ac549e3d56ad3a7252c71a07681218da2726d8247cc2
8ff1250168ba4cf1dd53cfafb0e6fa6f3ef44c195d4039fa6bcce0c2cfaaa7bf
a199fa64874f1381e59e5cf78db05d9137d21272bbceeeebda0b87f2d2328645
b8e01906baa839abb9828e7f0161991e061aae10af66fe91f9bb48539f7f404a
bb631cb41d70ab6f8a07ab80b053676bca8589e7e1d835827f30e1bffbed91c5
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d60a01e86a6701bf5d527ff6b176b7b501fc2638b5582fe22be89dabf5133720
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1b23a6200bdb4728ad055b6439a7055e73c62e61a97804fa6ac13871164c198
f6529ad8d18b0e4eb1e3a4d67404040a8cf88e0833751b3c1fb920fbef862e72