mail.cocobongo.net Open in urlscan Pro
135.181.59.167 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rb.gy/wviwd7#peter.st=
Effective URL:
https://mail.cocobongo.net/read/Wewe/index.php
Submission: On December 03 via api (December 3rd 2021, 11:16:38 am UTC) from IE — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 14 HTTP transactions. The main IP is 135.181.59.167, located in Helsinki, Finland and belongs to HETZNER-AS, DE. The main domain is mail.cocobongo.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 2nd 2021. Valid for: 3 months.

This is the only time mail.cocobongo.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.248.219.100 13.248.219.100	16509 (AMAZON-02) (AMAZON-02)
10	135.181.59.167 135.181.59.167	24940 (HETZNER-AS) (HETZNER-AS)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
14	5

1 13.248.219.100 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: abaa834e320054d4d.awsglobalaccelerator.com

rb.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 135.181.59.167 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.167.59.181.135.clients.your-server.de

mail.cocobongo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	cocobongo.net mail.cocobongo.net	966 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	32 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	11 KB
1	jquery.com code.jquery.com	33 KB
1	rb.gy 1 redirects rb.gy	237 B
14	5

	Domain	Requested by
10	mail.cocobongo.net	mail.cocobongo.net
1	fonts.googleapis.com	mail.cocobongo.net
1	maxcdn.bootstrapcdn.com	mail.cocobongo.net
1	ajax.googleapis.com	mail.cocobongo.net
1	code.jquery.com	mail.cocobongo.net
1	rb.gy	1 redirects
14	6

This site contains no links.

Subject Issuer	Validity	Valid
mail.cocobongo.net cPanel, Inc. Certification Authority	`2021-10-02` - `2021-12-31`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mail.cocobongo.net/read/Wewe/index.php
Frame ID: 02F611A752353FD7BC6B02FF2A7D160C
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WeTransfer

Page URL History Show full URLs

https://rb.gy/wviwd7 HTTP 301
https://mail.cocobongo.net/read/Wewe/index.php Page URL

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

5
IPs

4
Countries

1041 kB
Transfer

1201 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rb.gy/wviwd7 HTTP 301
https://mail.cocobongo.net/read/Wewe/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.php Show response
mail.cocobongo.net/read/Wewe/
Redirect Chain

https://rb.gy/wviwd7
https://mail.cocobongo.net/read/Wewe/index.php

4 KB
4 KB

203ms
136ms

Document
text/html

135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: 32f9b90bd754970faf17b3dfe9afe76d43114e48fb20fc2411a4c68dc3b39490

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 03 Dec 2021 11:16:31 GMT
Content-Length: 0
Cache-Control: no-cache, no-store
Expires: -1
Location: https://mail.cocobongo.net/read/Wewe/index.php
Engine: Rebrandly.redirect, version 2.1

GET
H2 200 jquery.min.js Show response
code.jquery.com/ 94 KB
33 KB 55ms
17ms Script
application/javascript 2001:4de0:ac18::1:a:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery.min.js
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 11:16:32 GMT
content-encoding: gzip
last-modified: Fri, 24 Oct 2014 00:16:08 GMT
server: nginx
etag: "54499a48-1764d"
vary: Accept-Encoding
x-hw: 1638530192.dop011.ml1.t,1638530192.cds210.ml1.hn,1638530192.cds203.ml1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 33226

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 13:40:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77733
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 02 Dec 2022 13:40:59 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/ 37 KB
11 KB 79ms
30ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js

Requested by

Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 11:16:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 565, 617, 617
age: 19379255
cdn-cachedat: 2021-04-23 06:05:18
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: d44b997c059b29f676fef0c1ef13ecf2
cf-ray: 6b7c62257d6983a8-MXP
cdn-requestcountrycode: EG
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 21 KB
1 KB 40ms
17ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito:200,200i,300,300i,400,400i,600,600i,700,700i,800,800i,900,900i

Requested by

Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4a8463c1438fd24c66fad58640d1ca89db081a59807a4e240969c02f5d9eb6a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 03 Dec 2021 10:11:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 03 Dec 2021 11:16:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Dec 2021 11:16:32 GMT

GET
H/1.1 200
OK grwwk.css
mail.cocobongo.net/read/Wewe/css/ 235 KB
235 KB 28ms
27ms Stylesheet
text/css 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: d989c9439ce32cfdf6e6ee57538e8f127b9074cf862682faece9e4e4673908be

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Last-Modified: Sun, 10 Mar 2019 09:19:58 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 240342

GET
H/1.1 200
OK logo.png
mail.cocobongo.net/read/Wewe/img/ 63 KB
64 KB 81ms
27ms Image
image/png 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.cocobongo.net/read/Wewe/img/logo.png
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: ace77fd30206ec8338ee91a103f7f77adca8b2bdef251b1f350ce27d53d7bfcc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Last-Modified: Sat, 09 Mar 2019 11:20:06 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 64827

GET
H/1.1 404
Not Found jquery.min.js
mail.cocobongo.net/read/Wewe/vendor/jquery/ 0
0 57ms
26ms Script
text/html 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.cocobongo.net/read/Wewe/vendor/jquery/jquery.min.js
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found bootstrap.bundle.min.js
mail.cocobongo.net/read/Wewe/vendor/bootstrap/js/ 0
0 77ms
28ms Script
text/html 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.cocobongo.net/read/Wewe/vendor/bootstrap/js/bootstrap.bundle.min.js
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found jquery.easing.min.js
mail.cocobongo.net/read/Wewe/vendor/jquery-easing/ 0
0 181ms
128ms Script
text/html 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.cocobongo.net/read/Wewe/vendor/jquery-easing/jquery.easing.min.js
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK sb-admin-2.min.js Show response
mail.cocobongo.net/read/Wewe/js/ 1 KB
1 KB 213ms
159ms Script
application/javascript 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.cocobongo.net/read/Wewe/js/sb-admin-2.min.js
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/index.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: 924aa1d39f73a93d94492e0c71afe269bafc639a03f94d06928736455e14bfb6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Last-Modified: Sat, 09 Mar 2019 11:04:20 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1106

GET
H/1.1 200
OK bg.jpg
mail.cocobongo.net/read/Wewe/img/ 551 KB
552 KB 70ms
54ms Image
image/jpeg 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.cocobongo.net/read/Wewe/img/bg.jpg
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: 54e3b6d644a38b1918f23ffea460b03f2ff3fe96d583e892eca165345352ed48

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Last-Modified: Wed, 01 Dec 2021 18:24:53 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 564569

GET
H/1.1 200
OK arrow.png
mail.cocobongo.net/read/Wewe/img/ 58 KB
59 KB 60ms
48ms Image
image/png 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.cocobongo.net/read/Wewe/img/arrow.png
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: 468a524ffbc16d26f9237ef8b7bab0e8d92370f22f12630e2795c54b1297944b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Last-Modified: Sat, 09 Mar 2019 11:38:22 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 59877

GET
H/1.1 200
OK tent.png
mail.cocobongo.net/read/Wewe/img/ 51 KB
51 KB 31ms
30ms Image
image/png 135.181.59.167
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.cocobongo.net/read/Wewe/img/tent.png
Requested by: Host: mail.cocobongo.net
URL: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 135.181.59.167 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.167.59.181.135.clients.your-server.de
Software: Apache /
Resource Hash: f83a0f50000325deac64a58ebdb77aca091de863ac26b4c563bc28b8e8195f7f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.cocobongo.net/read/Wewe/css/grwwk.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 03 Dec 2021 11:16:32 GMT
Last-Modified: Sat, 09 Mar 2019 11:47:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 52309

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mail.cocobongo.net/read/Wewe/vendor/jquery/jquery.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://mail.cocobongo.net/read/Wewe/vendor/bootstrap/js/bootstrap.bundle.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://mail.cocobongo.net/read/Wewe/vendor/jquery-easing/jquery.easing.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
fonts.googleapis.com
mail.cocobongo.net
maxcdn.bootstrapcdn.com
rb.gy
13.248.219.100
135.181.59.167
2001:4de0:ac18::1:a:2b
2606:4700::6812:acf
2a00:1450:4001:811::200a
2a00:1450:4001:82b::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
32f9b90bd754970faf17b3dfe9afe76d43114e48fb20fc2411a4c68dc3b39490
468a524ffbc16d26f9237ef8b7bab0e8d92370f22f12630e2795c54b1297944b
4a8463c1438fd24c66fad58640d1ca89db081a59807a4e240969c02f5d9eb6a0
4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376
54e3b6d644a38b1918f23ffea460b03f2ff3fe96d583e892eca165345352ed48
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
924aa1d39f73a93d94492e0c71afe269bafc639a03f94d06928736455e14bfb6
ace77fd30206ec8338ee91a103f7f77adca8b2bdef251b1f350ce27d53d7bfcc
d989c9439ce32cfdf6e6ee57538e8f127b9074cf862682faece9e4e4673908be
f83a0f50000325deac64a58ebdb77aca091de863ac26b4c563bc28b8e8195f7f

mail.cocobongo.net Open in urlscan Pro 135.181.59.167 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

5 Domains

6 Subdomains

5 IPs

4 Countries

1041 kBTransfer

1201 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

mail.cocobongo.net Open in urlscan Pro
135.181.59.167 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

5
IPs

4
Countries

1041 kB
Transfer

1201 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!