lngdirects.4lima.de Open in urlscan Pro
2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lngdirects.4lima.de/es768/AB_74588e/code.php
Submission: On May 20 via automatic, source openphish (May 20th 2019, 5:02:36 pm UTC)

Summary HTTP 22 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 2a00:f48:2000:affe::50, located in Germany and belongs to TTM, DE. The main domain is lngdirects.4lima.de.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 20th 2019. Valid for: 3 months.

This is the only time lngdirects.4lima.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address		AS Autonomous System
22	2a00:f48:2000... 2a00:f48:2000:affe::50		47447 (TTM) (TTM)
22	1

22 2a00:f48:2000:affe::50 (Germany)

ASN47447 (TTM, DE)

lngdirects.4lima.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	4lima.de lngdirects.4lima.de	594 KB
22	1

	Domain	Requested by
22	lngdirects.4lima.de	lngdirects.4lima.de
22	1

This site contains links to these domains. Also see Links.

Domain
ing.ingdirect.es

Subject Issuer	Validity	Valid
lngdirects.4lima.de Let's Encrypt Authority X3	`2019-05-20` - `2019-08-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lngdirects.4lima.de/es768/AB_74588e/code.php
Frame ID: 8AFD6F3FAE8F6DBC9802715ECD3AEA65
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

22
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

594 kB
Transfer

3682 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://ing.ingdirect.es/W/Transactional/adf/images/sobre-ing/cookies_transaccional.html
Title: Política de cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request code.php Show response
lngdirects.4lima.de/es768/AB_74588e/ 37 KB
9 KB 12ms
11ms Document
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

56d8a2b7ae9ee24f04974e1e9cb5ef273c84ec0da921dd2a362060afba20b9d3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

:method: GET
:authority: lngdirects.4lima.de
:scheme: https
:path: /es768/AB_74588e/code.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: openresty
date: Mon, 20 May 2019 17:02:19 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding
x-lima-id: heWBAVlyEagcHxOwzZ
set-cookie: _lcp=a; Path=/; expires=Mon Mar 20 2034 13:02:58
content-security-policy: upgrade-insecure-requests
x-powered-by: PHP/7.1.29
content-encoding: gzip

GET
H2 404 s23984268574907
lngdirects.4lima.de/es768/content/ 0
0 117ms
116ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/s23984268574907

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heReBejjwUgpgb0gwt
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 transactional.css
lngdirects.4lima.de/es768/content/ 3 MB
457 KB 12ms
12ms Stylesheet
text/css 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/transactional.css

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

478ef9dee9f0fdd1c9e27a4e9852be164f52cd19dd1bd0b48f5a695f6666f883

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: W/"368faa-58951eed75900"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
status: 200
x-lima-id: heLISyt4szoIc9g4Ak
content-security-policy: upgrade-insecure-requests
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 404 utag_003.js
lngdirects.4lima.de/es768/content/ 0
0 116ms
115ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/utag_003.js

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heZdWMl2ExXs0SClqN
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 GlobalConfiguration.js
lngdirects.4lima.de/es768/content/ 0
0 113ms
112ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/GlobalConfiguration.js

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heHDgn16brTWFAkqkQ
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 login.js
lngdirects.4lima.de/es768/content/ 0
0 113ms
112ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/login.js

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heVWVFmCcKa0pyFiJj
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 logoING.svg
lngdirects.4lima.de/es768/content/ 33 KB
13 KB 110ms
109ms Image
image/svg+xml 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/logoING.svg

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
etag: W/"84d7-58951eed75900"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-lima-id: heUci0VKCt5n7Viijx
content-security-policy: upgrade-insecure-requests

GET
H2 200 phone.png
lngdirects.4lima.de/es768/content/ 416 B
677 B 16ms
15ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/phone.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

8bc3bec9b0f346f723e2753d31e93fb41afcf1972cc8daad655351a6ad3021f6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: "1a0-58951eed75900"
content-type: image/png
status: 200
x-lima-id: hedh6GJ6BlCPd346Wr
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 416
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 norton-logo.png
lngdirects.4lima.de/es768/content/ 8 KB
9 KB 13ms
13ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/norton-logo.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

9333473effc6bced92f7eb03baefe1cfb2075e28298c0c0ce930c8fe915365b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: "20f8-58951eed75900"
content-type: image/png
status: 200
x-lima-id: he1YpyxqkElxvzBKbE
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 8440
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 LogoDNIE-trazado.svg
lngdirects.4lima.de/es768/content/ 13 KB
5 KB 12ms
11ms Image
image/svg+xml 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/LogoDNIE-trazado.svg

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
etag: W/"32db-58951eed75900"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-lima-id: heFQDOSIfJepZeKBaN
content-security-policy: upgrade-insecure-requests

GET
H2 404 footerimg.png
lngdirects.4lima.de/es768/content/ 9 KB
9 KB 67ms
66ms Image
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/footerimg.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

c28618c3a91f4c2da0521a8f24a6e2b17c538d0580bcce641f82f0196112a2e4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:19 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heAlNSJ4HetrEmURXR
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 banner-login_1164x300.jpg
lngdirects.4lima.de/es768/content/ 87 KB
87 KB 10ms
10ms Image
image/jpeg 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/banner-login_1164x300.jpg

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/content/transactional.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "15ad7-58951ed2c1a00"
content-type: image/jpeg
status: 200
x-lima-id: heVDTT4MGCqB66QfKF
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 88791
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 2.png
lngdirects.4lima.de/es768/content/ 334 B
594 B 11ms
11ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/2.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

dc688b28d8da5c86d8e9b9fef1c0e5bca92a691353f8801fce8b47190bc7a13b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "14e-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: hefxP4bNflAV69zZOp
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 334
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 9.png
lngdirects.4lima.de/es768/content/ 336 B
596 B 17ms
17ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/9.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

5ab618fd86d2428f95789a3729291eb446e1df9d2967942df94c5c068f1ad02d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "150-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: hewHzmNIlOpBhAxgjt
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 336
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 5.png
lngdirects.4lima.de/es768/content/ 289 B
548 B 16ms
15ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/5.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

05f2ba3daabdde4c543227c3fb7377433dd02e31b2b2ac898b3f648048f185e0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "121-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: hejJyGnDLupK50o1ee
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 289
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 8.png
lngdirects.4lima.de/es768/content/ 351 B
612 B 17ms
16ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/8.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

0aee085e1b842ea70599b0e58b8572777b013b2e2a6fa64c6e3e28e8807ec55e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "15f-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: heyPjRuS2GMCGYMsvA
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 351
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 0.png
lngdirects.4lima.de/es768/content/ 303 B
563 B 16ms
16ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/0.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

f3be45d5bfc8a0dd6194909b306b95f31cb3c32369606fd690c3b2c08d2a29aa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "12f-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: heij13NM4dvxXky7Pp
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 303
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 4.png
lngdirects.4lima.de/es768/content/ 295 B
554 B 14ms
14ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/4.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

bac7de34ac8b21a9ba4b2ab1859cb3595200db81349b8f77ce4ea9e81b9f8f26

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "127-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: he3Rdg2dhNb99A6gVI
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 295
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 7.png
lngdirects.4lima.de/es768/content/ 291 B
550 B 14ms
13ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/7.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

b12401988c36839ba03da621ff6ad9eb03583fa07a67f0ab9c06e220e5f3a7e7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "123-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: heBv5a5uf9s0PrPrS1
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 291
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 3.png
lngdirects.4lima.de/es768/content/ 335 B
597 B 11ms
10ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/3.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

b711fcfa2225477a816d5dcfe4aa4bca56b2b4d56ab2d23adb5ba3570d3c371f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "14f-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: heZkIvhrWWGBpBJUNQ
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 335
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 1.png
lngdirects.4lima.de/es768/content/ 233 B
492 B 11ms
10ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/1.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

81aa6c363036cd69da56f275ed90e4cb79f53366f9d47bb18c9dad1f2a48abae

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "e9-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: hekQ9vTyh78ee4hIh1
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 233
expires: Wed, 19 Jun 2019 17:02:19 GMT

GET
H2 200 6.png
lngdirects.4lima.de/es768/content/ 329 B
589 B 14ms
14ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/6.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_74588e/code.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

ddf15d0564ec82456046993d97fc0a3c89a4b4b88c552dc69fb0c64696a1c5e0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_74588e/code.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "149-58951ed2c1a00"
content-type: image/png
status: 200
x-lima-id: hed4W3Vo5my82YkvK2
date: Mon, 20 May 2019 17:02:19 GMT
accept-ranges: bytes
content-length: 329
expires: Wed, 19 Jun 2019 17:02:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lngdirects.4lima.de/	1970-01-24 10:54:32	Name: _lcp2 Value: a
			lngdirects.4lima.de/	1970-01-24 10:54:32	Name: _lcp Value: a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lngdirects.4lima.de
2a00:f48:2000:affe::50
05f2ba3daabdde4c543227c3fb7377433dd02e31b2b2ac898b3f648048f185e0
0aee085e1b842ea70599b0e58b8572777b013b2e2a6fa64c6e3e28e8807ec55e
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
478ef9dee9f0fdd1c9e27a4e9852be164f52cd19dd1bd0b48f5a695f6666f883
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
56d8a2b7ae9ee24f04974e1e9cb5ef273c84ec0da921dd2a362060afba20b9d3
5ab618fd86d2428f95789a3729291eb446e1df9d2967942df94c5c068f1ad02d
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
81aa6c363036cd69da56f275ed90e4cb79f53366f9d47bb18c9dad1f2a48abae
8bc3bec9b0f346f723e2753d31e93fb41afcf1972cc8daad655351a6ad3021f6
9333473effc6bced92f7eb03baefe1cfb2075e28298c0c0ce930c8fe915365b0
b12401988c36839ba03da621ff6ad9eb03583fa07a67f0ab9c06e220e5f3a7e7
b711fcfa2225477a816d5dcfe4aa4bca56b2b4d56ab2d23adb5ba3570d3c371f
bac7de34ac8b21a9ba4b2ab1859cb3595200db81349b8f77ce4ea9e81b9f8f26
c28618c3a91f4c2da0521a8f24a6e2b17c538d0580bcce641f82f0196112a2e4
dc688b28d8da5c86d8e9b9fef1c0e5bca92a691353f8801fce8b47190bc7a13b
ddf15d0564ec82456046993d97fc0a3c89a4b4b88c552dc69fb0c64696a1c5e0
f3be45d5bfc8a0dd6194909b306b95f31cb3c32369606fd690c3b2c08d2a29aa

lngdirects.4lima.de Open in urlscan Pro 2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

594 kBTransfer

3682 kBSize

2 Cookies

1 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

lngdirects.4lima.de Open in urlscan Pro
2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

594 kB
Transfer

3682 kB
Size

2
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!