www.bike-shop-hintermayr.de Open in urlscan Pro
87.238.192.13 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.meteocity.fr/c/?t=1c3de9d-4-fcc12-i4w!-!i8cc&redir=https%3A%2F%2Fcarlaunge.com%2Fwp-admin%2Fkqoif%2F
Effective URL:
https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23...
Submission: On July 24 via manual (July 24th 2020, 6:26:54 am UTC) from NO

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 10 HTTP transactions. The main IP is 87.238.192.13, located in Germany and belongs to EVANZOAS, DE. The main domain is www.bike-shop-hintermayr.de.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 10th 2020. Valid for: 3 months.

This is the only time www.bike-shop-hintermayr.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a05:71c0:200... 2a05:71c0:2000::e	34993 (ODISO-AS) (ODISO-AS)
1 1	103.20.212.182 103.20.212.182	17439 (NETMAGIC-...) (NETMAGIC-AP Netmagic Datacenter Mumbai)
1 9	87.238.192.13 87.238.192.13	42730 (EVANZOAS) (EVANZOAS)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::2003	15169 (GOOGLE) (GOOGLE)
10	3

1 2a05:71c0:2000::e (France) 1 redirects

ASN34993 (ODISO-AS, FR)

t.meteocity.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.20.212.182 (Faridabad, India) 1 redirects

ASN17439 (NETMAGIC-AP Netmagic Datacenter Mumbai, IN)

carlaunge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 87.238.192.13 (Germany) 1 redirects

ASN42730 (EVANZOAS, DE)

www.bike-shop-hintermayr.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	bike-shop-hintermayr.de 1 redirects www.bike-shop-hintermayr.de	56 KB
1	gstatic.com fonts.gstatic.com	9 KB
1	googleapis.com fonts.googleapis.com	776 B
1	carlaunge.com 1 redirects carlaunge.com	133 B
1	meteocity.fr 1 redirects t.meteocity.fr	406 B
10	5

	Domain	Requested by
9	www.bike-shop-hintermayr.de	1 redirects www.bike-shop-hintermayr.de
1	fonts.gstatic.com	www.bike-shop-hintermayr.de
1	fonts.googleapis.com	www.bike-shop-hintermayr.de
1	carlaunge.com	1 redirects
1	t.meteocity.fr	1 redirects
10	5

This site contains links to these domains. Also see Links.

Domain
www.nordea.no

Subject Issuer	Validity	Valid
bike-shop-hintermayr.de Let's Encrypt Authority X3	`2020-07-10` - `2020-10-08`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Frame ID: EF93EA0BF9153767C81F12C87719021E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.meteocity.fr/c/?t=1c3de9d-4-fcc12-i4w!-!i8cc&redir=https%3A%2F%2Fcarlaunge.com%2Fwp-admin... HTTP 302
https://carlaunge.com/wp-admin/kqoif/ HTTP 302
https://www.bike-shop-hintermayr.de/ads/www/ HTTP 302
https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b2... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

65 kB
Transfer

231 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.no/
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.meteocity.fr/c/?t=1c3de9d-4-fcc12-i4w!-!i8cc&redir=https%3A%2F%2Fcarlaunge.com%2Fwp-admin%2Fkqoif%2F HTTP 302
https://carlaunge.com/wp-admin/kqoif/ HTTP 302
https://www.bike-shop-hintermayr.de/ads/www/ HTTP 302
https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.php Show response
www.bike-shop-hintermayr.de/ads/www/
Redirect Chain

https://t.meteocity.fr/c/?t=1c3de9d-4-fcc12-i4w!-!i8cc&redir=https%3A%2F%2Fcarlaunge.com%2Fwp-admin%2Fkqoif%2F
https://carlaunge.com/wp-admin/kqoif/
https://www.bike-shop-hintermayr.de/ads/www/
https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f48198...

13 KB
4 KB

23ms
22ms

Document
text/html

87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PHP/7.1.26 PleskLin
Resource Hash: c0ef5e41406890acc209f0c3d1c53a65ec66af9cb7953d1fa3f4d2cdefbf78f7

Request headers

Host: www.bike-shop-hintermayr.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=sgeq1fpvlosv3uioccdcrndtl1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Server: Apache
X-Powered-By: PHP/7.1.26 PleskLin
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3469
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Server: Apache
X-Powered-By: PHP/7.1.26 PleskLin
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=sgeq1fpvlosv3uioccdcrndtl1; path=/
location: login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK bootstrap.min.css
www.bike-shop-hintermayr.de/ads/www/assets/ 98 KB
17 KB 29ms
27ms Stylesheet
text/css 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets/bootstrap.min.css
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 15:12:08 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b43643-18679-59e7683326200"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 17162

GET
H/1.1 200
OK animate.min.css
www.bike-shop-hintermayr.de/ads/www/assets/ 47 KB
5 KB 60ms
23ms Stylesheet
text/css 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets/animate.min.css
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: fa61f9a7c2e4aaa831b61058a814316ebc4cedcf82325869d4ddaade239066c8

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 15:11:00 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b43648-ba44-59e767f24c900"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 4396

GET
H/1.1 200
OK font-awesome.min.css
www.bike-shop-hintermayr.de/ads/www/assets/ 30 KB
7 KB 69ms
27ms Stylesheet
text/css 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets/font-awesome.min.css
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 15:11:58 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b43642-7918-59e768299cb80"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7053

GET
H2 200 css
fonts.googleapis.com/ 5 KB
776 B 18ms
16ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,300

Requested by

Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bfa21901e87e44f386b8208764bc596acaaaa085e560bf989d40982eb0e5a7c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 24 Jul 2020 05:02:13 GMT
server: ESF
date: Fri, 24 Jul 2020 06:26:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 24 Jul 2020 06:26:38 GMT

GET
H/1.1 200
OK main.min.css
www.bike-shop-hintermayr.de/ads/www/assets// 11 KB
2 KB 67ms
25ms Stylesheet
text/css 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets//main.min.css
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: 18521983a3ed5e76f27be85023b93bb7e21301750cbbfb163e8d7bbe7e8fd2ef

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 15:12:10 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b43647-2b84-59e768350e680"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2181

GET
H/1.1 200
OK app-store-badge.svg
www.bike-shop-hintermayr.de/ads/www/assets// 10 KB
11 KB 63ms
21ms Image
image/svg+xml 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets//app-store-badge.svg
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: 4f42f4e66299f2e67d7890f435901468dc9c7e7824c5eb1896774ab32a80cf79

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Last-Modified: Thu, 13 Feb 2020 15:14:24 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b4363b-29d4-59e768b4d9400"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 10708

GET
H/1.1 200
OK google-play-store-badge.svg
www.bike-shop-hintermayr.de/ads/www/assets/ 7 KB
7 KB 65ms
21ms Image
image/svg+xml 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets/google-play-store-badge.svg
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: 5a413ebf7a43a7e00d4fdeb7eab02f263db68be30ae07039ba6bde500934ed32

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Last-Modified: Thu, 13 Feb 2020 15:14:46 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b4363e-1afe-59e768c9d4580"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 6910

GET
H/1.1 200
OK mobile-app-qr-code.png
www.bike-shop-hintermayr.de/ads/www/assets/ 2 KB
2 KB 33ms
24ms Image
image/png 87.238.192.13
EVANZOAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bike-shop-hintermayr.de/ads/www/assets/mobile-app-qr-code.png
Requested by: Host: www.bike-shop-hintermayr.de
URL: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 87.238.192.13 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
Software: Apache / PleskLin
Resource Hash: 0f60979b728ce4cf2de33e6a9765c7adc5df57246d00478d0d1b5ef026754a76

Request headers

Referer: https://www.bike-shop-hintermayr.de/ads/www/login.php?cmd=login_submit&id=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120&session=1732b25665c4f481989a395e23eec1201732b25665c4f481989a395e23eec120
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 24 Jul 2020 06:26:38 GMT
Last-Modified: Thu, 13 Feb 2020 15:14:58 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "1b4363a-7e1-59e768d546080"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2017

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,300
Origin: https://www.bike-shop-hintermayr.de

Response headers

date: Thu, 11 Jun 2020 13:03:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 3691394
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Fri, 11 Jun 2021 13:03:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.bike-shop-hintermayr.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: sgeq1fpvlosv3uioccdcrndtl1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

carlaunge.com
fonts.googleapis.com
fonts.gstatic.com
t.meteocity.fr
www.bike-shop-hintermayr.de
103.20.212.182
2a00:1450:4001:800::200a
2a00:1450:4001:824::2003
2a05:71c0:2000::e
87.238.192.13
0f60979b728ce4cf2de33e6a9765c7adc5df57246d00478d0d1b5ef026754a76
18521983a3ed5e76f27be85023b93bb7e21301750cbbfb163e8d7bbe7e8fd2ef
4f42f4e66299f2e67d7890f435901468dc9c7e7824c5eb1896774ab32a80cf79
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5a413ebf7a43a7e00d4fdeb7eab02f263db68be30ae07039ba6bde500934ed32
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
bfa21901e87e44f386b8208764bc596acaaaa085e560bf989d40982eb0e5a7c8
c0ef5e41406890acc209f0c3d1c53a65ec66af9cb7953d1fa3f4d2cdefbf78f7
e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b
fa61f9a7c2e4aaa831b61058a814316ebc4cedcf82325869d4ddaade239066c8

www.bike-shop-hintermayr.de Open in urlscan Pro 87.238.192.13 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

3 IPs

3 Countries

65 kBTransfer

231 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

www.bike-shop-hintermayr.de Open in urlscan Pro
87.238.192.13 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

65 kB
Transfer

231 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!