user.behpoosh.shop Open in urlscan Pro
185.189.149.241 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://user.behpoosh.shop/
Effective URL:
https://user.behpoosh.shop/de-ch
Submission: On February 07 via automatic, source certstream-suspicious (February 7th 2023, 4:38:56 am UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 185.189.149.241, located in Switzerland and belongs to AS-SOFTPLUS, CH. The main domain is user.behpoosh.shop.
TLS certificate: Issued by R3 on February 7th 2023. Valid for: 3 months.

This is the only time user.behpoosh.shop was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	185.189.149.241 185.189.149.241	51395 (AS-SOFTPLUS) (AS-SOFTPLUS)
1	23.36.163.108 23.36.163.108	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	3

3 185.189.149.241 (Switzerland) 1 redirects

ASN51395 (AS-SOFTPLUS, CH)

user.behpoosh.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.163.108 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-108.deploy.static.akamaitechnologies.com

assets.msn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	behpoosh.shop 1 redirects user.behpoosh.shop	60 KB
1	msn.com assets.msn.com — Cisco Umbrella Rank: 147	7 KB
8	2

	Domain	Requested by
3	user.behpoosh.shop	1 redirects user.behpoosh.shop
1	assets.msn.com	user.behpoosh.shop assets.msn.com
8	2

This site contains no links.

Subject Issuer	Validity	Valid
user.behpoosh.shop R3	`2023-02-07` - `2023-05-08`	3 months	crt.sh
assets.msn.com Microsoft Azure TLS Issuing CA 01	`2022-08-11` - `2023-08-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://user.behpoosh.shop/de-ch
Frame ID: 813D2EC0FB09986DABF3FF6572E7BD41
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MSN

Page URL History Show full URLs

https://user.behpoosh.shop/ HTTP 302
https://user.behpoosh.shop/de-ch Page URL

Detected technologies

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

Page Statistics

8
Requests

38 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

65 kB
Transfer

136 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://user.behpoosh.shop/ HTTP 302
https://user.behpoosh.shop/de-ch Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request de-ch Show response
user.behpoosh.shop/
Redirect Chain

https://user.behpoosh.shop/
https://user.behpoosh.shop/de-ch

34 KB
36 KB

100ms
99ms

Document
text/html

185.189.149.241
AS-SOFTPLUS

General

Check archive.org

Show headers Download Go to

Full URL

https://user.behpoosh.shop/de-ch

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

185.189.149.241 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),

Reverse DNS

Software

Caddy /

Resource Hash

cd9da12789288b1e2160cf991e7580a90981741982a9d05ec7835a893fbea28e

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content;connect-src 'self' data: 'unsafe-inline' 'unsafe-eval' https: blob: wss:;default-src 'self' data: 'unsafe-inline' 'unsafe-eval' https: blob: wss: 'report-sample';font-src 'self' data: https: blob: wss: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-ancestors 'self' ntp.msn.com windows.msn.com int1.msn.com windows-int1.msn.com ntp.msn.cn windows.msn.cn www.bing.com;media-src 'self' https: blob:;report-to csp-endpoint;worker-src 'self' https: blob: 'report-sample';
Strict-Transport-Security	max-age=1209600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: HEAD,GET,OPTIONS
Cache-Control: no-store, no-cache
Content-Security-Policy: block-all-mixed-content;connect-src 'self' data: 'unsafe-inline' 'unsafe-eval' https: blob: wss:;default-src 'self' data: 'unsafe-inline' 'unsafe-eval' https: blob: wss: 'report-sample';font-src 'self' data: https: blob: wss: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-ancestors 'self' ntp.msn.com windows.msn.com int1.msn.com windows-int1.msn.com ntp.msn.cn windows.msn.cn www.bing.com;media-src 'self' https: blob:;report-to csp-endpoint;worker-src 'self' https: blob: 'report-sample';
Content-Type: text/html; charset=utf-8
Date: Tue, 07 Feb 2023 04:38:50 GMT
Nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5}
Pragma: no-cache
Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]}
Server: Caddy
Strict-Transport-Security: max-age=1209600; includeSubDomains; preload
Transfer-Encoding: chunked
X-Cache: CONFIG_NOCACHE
X-Content-Type-Options: nosniff
X-Fabric-Cluster: pmeprodneu
X-Frame-Options: SAMEORIGIN
X-Msedge-Ref: Ref A: 6101FC1D514643ACA7CB1FF6F1DE05D3 Ref B: ZRHEDGE0809 Ref C: 2023-02-07T04:38:51Z
X-Ua-Compatible: IE=Edge;chrome=1
X-Xss-Protection: 1

Redirect headers

Cache-Control: no-store, no-cache
Content-Length: 0
Date: Tue, 07 Feb 2023 04:38:50 GMT
Location: /de-ch
Nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5}
Pragma: no-cache
Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]}
Server: Caddy
Strict-Transport-Security: max-age=1209600; includeSubDomains; preload
X-Cache: CONFIG_NOCACHE
X-Fabric-Cluster: pmeprodneu
X-Msedge-Ref: Ref A: D52B662EDD9C45698A23BD815A852F0C Ref B: ZRHEDGE0809 Ref C: 2023-02-07T04:38:51Z

GET
H2 200 otSDKStub.js Show response
assets.msn.com/staticsb/statics/latest/oneTrust/1.5/scripttemplates/ 19 KB
7 KB 334ms
39ms Script
application/javascript 23.36.163.108
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.msn.com/staticsb/statics/latest/oneTrust/1.5/scripttemplates/otSDKStub.js
Requested by: Host: user.behpoosh.shop
URL: https://user.behpoosh.shop/de-ch
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.108 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-108.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 60bccd3568b2e57324f16036663e89721eaab7be58efcb5babf26da369c79233

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://user.behpoosh.shop/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 Feb 2023 04:38:52 GMT
content-encoding: gzip
akamai-cache-status: Hit from child
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
content-md5: Y7/+dPKCg0+OPHHgf5Uv/w==
server-timing: clientrtt; dur=39, clienttt; dur=0, origin; dur=0 , cdntime; dur=0
content-length: 6445
x-ms-lease-status: unlocked
last-modified: Sat, 04 Feb 2023 08:40:57 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8DB068B88E600A2
vary: Origin
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
content-type: application/javascript
x-ms-request-id: ac4a8d37-101e-0072-04b7-38618d000000
cache-control: public, max-age=1209600
akamai-server-ip: 23.36.161.80
x-ms-version: 2009-09-19
akamai-request-bc: [a=23.36.161.80,b=3259268694,c=g,n=DE_HE_FRANKFURT,o=20940]
akamai-request-id: c2447e56
timing-allow-origin: *

GET vendors.064c2e4a728002dd16d0.js
assets.msn.com/bundles/v1/homePage/latest/ 0
0

GET microsoft.9cce40e0726cba26b532.js
assets.msn.com/bundles/v1/homePage/latest/ 0
0

GET common.e745e115f121b0738481.js
assets.msn.com/bundles/v1/homePage/latest/ 0
0

GET experience.5da5d1c27bb546c8a333.js
assets.msn.com/bundles/v1/homePage/latest/ 0
0

GET 55a804ab-e5c6-4b97-9319-86263d365d28.json
assets.msn.com/staticsb/statics/latest/oneTrust/1.5/consent/55a804ab-e5c6-4b97-9319-86263d365d28/ 0
0

GET
H/1.1 200
OK web-worker.b3a5fa489064f286a287.js
user.behpoosh.shop/bundles/v1/homePage/latest/ 83 KB
23 KB 376ms
375ms Other
application/javascript 185.189.149.241
AS-SOFTPLUS

General

Check archive.org

Show headers Download Go to

Full URL: https://user.behpoosh.shop/bundles/v1/homePage/latest/web-worker.b3a5fa489064f286a287.js
Requested by: Host: user.behpoosh.shop
URL: https://user.behpoosh.shop/de-ch
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.189.149.241 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
Software: Caddy, Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: cd7bde5806012e4ed72dccf59968755de540efa26553c618e4fb5d64f0ffe533

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://user.behpoosh.shop/de-ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Ms-Blob-Type: BlockBlob
Akamai-Cache-Status: Hit from child
Content-Encoding: br
Date: Tue, 07 Feb 2023 04:38:51 GMT
Nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1}
Content-Md5: 1SZvmopIXa+piKA3ns7FmQ==
X-Cache: TCP_MISS
Server-Timing: clientrtt; dur=13, clienttt; dur=0, origin; dur=0 , cdntime; dur=0
Content-Length: 22138
X-Ms-Lease-Status: unlocked
Last-Modified: Wed, 25 Jan 2023 00:08:07 GMT
Server: Caddy, Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
X-Msedge-Ref: Ref A: 2847185489924BF09883285890AEC380 Ref B: ZRHEDGE0809 Ref C: 2023-02-07T04:38:52Z
Etag: 0x8DAFE683CF1948E
Vary: Origin
Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]}
Content-Type: application/javascript
X-Ms-Request-Id: b70eb146-401e-0038-23bf-317498000000
Cache-Control: public, no-transform, max-age=31535892
Akamai-Server-Ip: 23.72.255.19
X-Ms-Version: 2009-09-19
Akamai-Request-Bc: [a=23.72.255.19,b=125248163,c=g,n=NL__HAARLEM,o=20940]
Akamai-Request-Id: 77722a3
X-Cid: 7
Timing-Allow-Origin: *
X-Ccc: CH

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: assets.msn.com
URL: https://assets.msn.com/bundles/v1/homePage/latest/vendors.064c2e4a728002dd16d0.js

Domain: assets.msn.com
URL: https://assets.msn.com/bundles/v1/homePage/latest/microsoft.9cce40e0726cba26b532.js

Domain: assets.msn.com
URL: https://assets.msn.com/bundles/v1/homePage/latest/common.e745e115f121b0738481.js

Domain: assets.msn.com
URL: https://assets.msn.com/bundles/v1/homePage/latest/experience.5da5d1c27bb546c8a333.js

Domain: assets.msn.com
URL: https://assets.msn.com/staticsb/statics/latest/oneTrust/1.5/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			user.behpoosh.shop/	1970-01-20 19:05:04	Name: sptmarket Value: de-de\|\|ch\|de-ch\|de-ch\|de\|\|RefA=D52B662EDD9C45698A23BD815A852F0C.RefC=2023-02-07T04:38:51Z

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://user.behpoosh.shop/de-ch Message: Access to script at 'https://assets.msn.com/bundles/v1/homePage/latest/vendors.064c2e4a728002dd16d0.js' from origin 'https://user.behpoosh.shop' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://assets.msn.com/bundles/v1/homePage/latest/vendors.064c2e4a728002dd16d0.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://user.behpoosh.shop/de-ch Message: Access to script at 'https://assets.msn.com/bundles/v1/homePage/latest/microsoft.9cce40e0726cba26b532.js' from origin 'https://user.behpoosh.shop' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://assets.msn.com/bundles/v1/homePage/latest/microsoft.9cce40e0726cba26b532.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://user.behpoosh.shop/de-ch Message: Access to script at 'https://assets.msn.com/bundles/v1/homePage/latest/experience.5da5d1c27bb546c8a333.js' from origin 'https://user.behpoosh.shop' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://assets.msn.com/bundles/v1/homePage/latest/experience.5da5d1c27bb546c8a333.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://user.behpoosh.shop/de-ch Message: Access to script at 'https://assets.msn.com/bundles/v1/homePage/latest/common.e745e115f121b0738481.js' from origin 'https://user.behpoosh.shop' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://assets.msn.com/bundles/v1/homePage/latest/common.e745e115f121b0738481.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://user.behpoosh.shop/de-ch Message: Access to XMLHttpRequest at 'https://assets.msn.com/staticsb/statics/latest/oneTrust/1.5/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json' from origin 'https://user.behpoosh.shop' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://assets.msn.com/staticsb/statics/latest/oneTrust/1.5/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	block-all-mixed-content;connect-src 'self' data: 'unsafe-inline' 'unsafe-eval' https: blob: wss:;default-src 'self' data: 'unsafe-inline' 'unsafe-eval' https: blob: wss: 'report-sample';font-src 'self' data: https: blob: wss: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-ancestors 'self' ntp.msn.com windows.msn.com int1.msn.com windows-int1.msn.com ntp.msn.cn windows.msn.cn www.bing.com;media-src 'self' https: blob:;report-to csp-endpoint;worker-src 'self' https: blob: 'report-sample';
Strict-Transport-Security	max-age=1209600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.msn.com
user.behpoosh.shop
assets.msn.com
185.189.149.241
23.36.163.108
60bccd3568b2e57324f16036663e89721eaab7be58efcb5babf26da369c79233
cd7bde5806012e4ed72dccf59968755de540efa26553c618e4fb5d64f0ffe533
cd9da12789288b1e2160cf991e7580a90981741982a9d05ec7835a893fbea28e

user.behpoosh.shop Open in urlscan Pro 185.189.149.241 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

38 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

65 kBTransfer

136 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

1 Cookies

10 Console Messages

Security Headers

Indicators

user.behpoosh.shop Open in urlscan Pro
185.189.149.241 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

38 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

65 kB
Transfer

136 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions