| beautycenter-wassenberg.de/index.php/rundgang |  92.205.53.9 | | 3.9 kB |
URL User Request GET beautycenter-wassenberg.de/index.php/rundgang IP92.205.53.9:0 ASN#21499 Host Europe GmbH
File typeJavaScript source, ASCII text, with very long lines (11131), with CRLF, LF line terminators Hash826bee4fda4753129f0bc6f747711548 1424fd5366aa2c1453cee6e70cfbb749e8b01824 8fa4f5a98cdb5ecb8bb076eae251cde04ebd7290073705a05bdf60f17bb740ed
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /index.php/rundgang HTTP/1.1
Host: beautycenter-wassenberg.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 May 2024 07:33:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache-Status: BYPASS
Content-Encoding: gzip
|
|
| bind.bestresulttostart.com/m67LBk |  193.163.7.113 | 404 Not Found | 0 B |
URL GET HTTP/2bind.bestresulttostart.com/m67LBk IP193.163.7.113:443
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectbestresulttostart.com FingerprintF4:4C:F5:1D:A8:B6:9F:52:11:56:EC:A1:D7:C6:98:DF:2E:96:E0:4C ValidityMon, 08 Apr 2024 08:36:22 GMT - Sun, 07 Jul 2024 08:36:21 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Unknown malware | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /m67LBk HTTP/1.1
Host: bind.bestresulttostart.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: nginx
date: Tue, 07 May 2024 07:33:38 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
strict-transport-security: max-age=31536000;
X-Firefox-Spdy: h2
|
|
| beautycenter-wassenberg.de/favicon.ico | 92.205.53.9 | 404 Not Found | 173 B |
URL GET HTTP/1.1beautycenter-wassenberg.de/favicon.ico IP92.205.53.9:80 ASN#21499 Host Europe GmbH
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang
File typeHTML document, ASCII text Hash62962daa1b19bbcc2db10b7bfd531ea6 d64bae91091eda6a7532ebec06aa70893b79e1f8 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: beautycenter-wassenberg.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/index.php/rundgang
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 07 May 2024 07:33:39 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
|
|
| gate.getmygateway.com/KQGrXb?c=beautycenter-wassenberg.de |  45.140.146.101 | 200 OK | 0 B |
URL GET HTTP/2gate.getmygateway.com/KQGrXb?c=beautycenter-wassenberg.de IP45.140.146.101:443 ASN#44477 Stark Industries Solutions Ltd
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectgate.getmygateway.com FingerprintF2:E0:B0:7B:1E:89:C9:4D:C8:55:A1:09:83:F6:7D:58:9F:98:0A:46 ValidityFri, 15 Mar 2024 02:12:16 GMT - Thu, 13 Jun 2024 02:12:15 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /KQGrXb?c=beautycenter-wassenberg.de HTTP/1.1
Host: gate.getmygateway.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 07 May 2024 07:33:39 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
cache-control: no-cache, no-store, must-revalidate
expires: Tue, 07 May 2024 07:33:39 GMT
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| bind.bestresulttostart.com/scripts/statistics.js?s=5.4.2 | 193.163.7.113 | 200 OK | 8.4 kB |
URL GET HTTP/2bind.bestresulttostart.com/scripts/statistics.js?s=5.4.2 IP193.163.7.113:443
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectbestresulttostart.com FingerprintF4:4C:F5:1D:A8:B6:9F:52:11:56:EC:A1:D7:C6:98:DF:2E:96:E0:4C ValidityMon, 08 Apr 2024 08:36:22 GMT - Sun, 07 Jul 2024 08:36:21 GMT
File typegzip compressed data, from Unix Hashe5eaefe921b4bdeb8a0e6901c690cb56 95b32ddc0fa8039e8f1b1c28d275252fceb6f565 0b21c2f0b1ad864d38a32cd9460c79b12a89da513ea991e357861c3c5a8de607
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Unknown malware | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /scripts/statistics.js?s=5.4.2 HTTP/1.1
Host: bind.bestresulttostart.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 07 May 2024 07:33:38 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 30 Apr 2024 15:15:36 GMT
vary: Accept-Encoding
etag: W/"66310b18-285b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| api.statisticsong.com/scripts/r.js |  0.0.0.0 | | 0 B |
URL GET api.statisticsong.com/scripts/r.js IP0.0.0.0:0
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /scripts/r.js HTTP/1.1
Host: api.statisticsong.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| lists.clickandanalytics.com/9BcW9F | 45.140.146.101 | 200 OK | 15 kB |
URL GET HTTP/2lists.clickandanalytics.com/9BcW9F IP45.140.146.101:443 ASN#44477 Stark Industries Solutions Ltd
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectcollect.clickandanalytics.com FingerprintF4:17:1E:5D:BF:87:33:FD:05:62:19:CA:43:50:59:23:2B:D3:13:C0 ValidityFri, 15 Mar 2024 02:13:25 GMT - Thu, 13 Jun 2024 02:13:24 GMT
File typeJavaScript source, ASCII text, with very long lines (15287), with no line terminators Hashb0149465e313403016a11ea7df794a63 3818a94fc421c0788c7db55adc59d58318f26d4b 94b3871c5af9ca42f481e355e3183d28ba94ef16165db7b07873248898735dd0
GET /9BcW9F HTTP/1.1
Host: lists.clickandanalytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 07 May 2024 07:33:39 GMT
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
expires: Tue, 07 May 2024 07:33:39 GMT
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| js.cdntoswitchspirit.com/source/split.js |  172.67.209.227 | 200 OK | 36 kB |
URL GET HTTP/3js.cdntoswitchspirit.com/source/split.js IP172.67.209.227:443
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectcdntoswitchspirit.com FingerprintDF:DB:EE:70:5A:39:BB:E7:A9:C6:4B:5C:24:04:56:6B:D0:D3:C0:AD ValidityMon, 29 Apr 2024 10:49:03 GMT - Sun, 28 Jul 2024 10:49:02 GMT
File typeJavaScript source, ASCII text, with very long lines (36341), with no line terminators Hashfe59aea1c787d361c69c43c46a747767 2cc61a29d05db4814718cc60450876419afc5d24 9763b6045876ff0f6ddf7f20e19d631346a2f132e675ff1601896b3625fd9816
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /source/split.js HTTP/1.1
Host: js.cdntoswitchspirit.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:33:38 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 30 Apr 2024 15:35:14 GMT
vary: Accept-Encoding
etag: W/"66310fb2-8df5"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 220999
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LXTrnV19ObcEV17LV3HkULZrhbdMTbORjk%2F3l%2FwltK35v0lLqoUkBPSoiTxghOHQWUJSkIbTDDJqt2g7tHk4EFnD9h5uUTdUM2yVtSdQY4atZS71RcRl%2BboO5JXwwtLAqlCiO%2B5k4h76Gjg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff85e59d1d1c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| jquery.restartyourchoices.com/cdncollect?r1=beautycenter-wassenberg.de | 104.21.19.43 | 200 OK | 10 kB |
URL GET HTTP/2jquery.restartyourchoices.com/cdncollect?r1=beautycenter-wassenberg.de IP104.21.19.43:443
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectrestartyourchoices.com Fingerprint1E:64:C0:EA:CA:57:4F:66:CB:2A:33:CF:E5:2D:8D:F5:B1:21:CE:D6 ValidityThu, 02 May 2024 15:04:04 GMT - Wed, 31 Jul 2024 15:04:03 GMT
File typeJavaScript source, ASCII text, with very long lines (10370) Hasha670ec3dd6fa757de5d5aab7abddfe59 07efb08354a342ae821e52b60728a31945c95759 a9aa76d5655c965f1feceec22619fa26acb1c4832f76ea25a79201bbc2b2c2f0
GET /cdncollect?r1=beautycenter-wassenberg.de HTTP/1.1
Host: jquery.restartyourchoices.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 07 May 2024 07:33:39 GMT
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
expires: Tue, 07 May 2024 07:33:39 GMT
set-cookie: _subid=376l60jidc1br; expires=Fri, 07 Jun 2024 07:33:39 GMT; path=/
a4fba=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjQxXCI6MTcxNTA2NzIxOX0sXCJjYW1wYWlnbnNcIjp7XCIxM1wiOjE3MTUwNjcyMTl9LFwidGltZVwiOjE3MTUwNjcyMTl9In0.RsYI_DBhCzZ_LKELC-89YbpVwm0iaD9aYyJcGXoLTsE; expires=Mon, 12 Sep 2078 15:07:18 GMT; path=/
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0vh2Q9CTDy9IEiwyB%2FvTxntayOwMB0UXpO2meeXnWR0Quh12bDf4CYh7q6%2BbSfPREiCWxpgQqx71OOgEczwT8K%2Bjp0omZAN5%2BlE%2Bt7xs84ZHcPcRWtchZPg3Ok808AiQVteY7RF%2FujAI0IZoFK5aQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff85e6885cb521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| rest.cdntoswitchspirit.com/scripts/stack.js | 172.67.209.227 | 200 OK | 11 kB |
URL GET HTTP/2rest.cdntoswitchspirit.com/scripts/stack.js IP172.67.209.227:443
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectcdntoswitchspirit.com FingerprintDF:DB:EE:70:5A:39:BB:E7:A9:C6:4B:5C:24:04:56:6B:D0:D3:C0:AD ValidityMon, 29 Apr 2024 10:49:03 GMT - Sun, 28 Jul 2024 10:49:02 GMT
File typeJavaScript source, ASCII text, with very long lines (10731), with no line terminators Hashe878b03a981d11cece993499461e5e06 31ebea7de3f1cfc6c81a9d37d8dfb3c3d7990e0e 857a06738b346b4d275749df845fb3fe2f296bfe49c031e170a1808478299198
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /scripts/stack.js HTTP/1.1
Host: rest.cdntoswitchspirit.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 07 May 2024 07:33:38 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 01 May 2024 16:05:11 GMT
vary: Accept-Encoding
etag: W/"66326837-29eb"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 220949
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xuqI3q1NIBjiRdA0PcjGDaeNp3k7BahALDYjLCBfKefK1%2FdBQGh3AHphF%2FUbwr0SIsFOaWsnn05ghlVQtgiFaO1RcCnkh0dLChGwXlsYeyWtJz59azj7fZGwmUHHAmNBS00FIxtZkVQ2w2VFxg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff85e4881e7130-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| js.cdntoswitchspirit.com/source/split.js | 172.67.209.227 | 200 OK | 36 kB |
URL GET HTTP/3js.cdntoswitchspirit.com/source/split.js IP172.67.209.227:443
Requested byhttp://beautycenter-wassenberg.de/index.php/rundgang CertificateIssuerLet's Encrypt Subjectcdntoswitchspirit.com FingerprintDF:DB:EE:70:5A:39:BB:E7:A9:C6:4B:5C:24:04:56:6B:D0:D3:C0:AD ValidityMon, 29 Apr 2024 10:49:03 GMT - Sun, 28 Jul 2024 10:49:02 GMT
File typeJavaScript source, ASCII text, with very long lines (36341), with no line terminators Hashfe59aea1c787d361c69c43c46a747767 2cc61a29d05db4814718cc60450876419afc5d24 9763b6045876ff0f6ddf7f20e19d631346a2f132e675ff1601896b3625fd9816
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /source/split.js HTTP/1.1
Host: js.cdntoswitchspirit.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://beautycenter-wassenberg.de/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:33:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 30 Apr 2024 15:35:14 GMT
vary: Accept-Encoding
etag: W/"66310fb2-8df5"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 221000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oG8uX2p44n7CKrQIbnRiKAe7tma95%2BLvPwtGfVmj7pENiMH7V7CV9MLHYG1L%2BXocECJThy0OXkGdXwBrcxNgs2jKF7cWsZoo0rTLX8B7Facom0IsOov6%2FOWT88or76lLCx9AYxiLR3zbWc4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff85e6fed51c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|