kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de Open in urlscan Pro
185.193.89.7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/26es8oag
Effective URL:
http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
Submission: On July 24 via manual (July 24th 2023, 7:13:59 am UTC) from DE — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 185.193.89.7, located in Russian Federation and belongs to ERISHENNYA-ASN, UA. The main domain is kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de.

This is the only time kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6814:8b41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	162.0.229.33 162.0.229.33	22612 (NAMECHEAP...) (NAMECHEAP-NET)
10	185.193.89.7 185.193.89.7	210950 (ERISHENNY...) (ERISHENNYA-ASN)
12	3

1 2606:4700:10::6814:8b41 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.0.229.33 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: littlechamps.school

quraniceducation.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 185.193.89.7 (Russian Federation)

ASN210950 (ERISHENNYA-ASN, UA)

kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	com.de kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de	461 KB
2	quraniceducation.online quraniceducation.online	1 KB
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 17979	552 B
12	3

	Domain	Requested by
10	kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de	kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
2	quraniceducation.online	quraniceducation.online
1	tinyurl.com	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
quraniceducation.online Sectigo RSA Domain Validation Secure Server CA	`2023-05-12` - `2024-05-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
Frame ID: 663F94A15E93F5972774C46CFEF3F683
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

comdirect Login - Ihr Online Banking & Brokerage | comdirect.de

Page URL History Show full URLs

https://tinyurl.com/26es8oag HTTP 301
https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php Page URL
https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php Page URL
http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

17 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

462 kB
Transfer

1559 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/26es8oag HTTP 301
https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php Page URL
https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php Page URL
http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/26es8oag HTTP 301
https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php

12 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

surgeries.php
quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/
Redirect Chain

https://tinyurl.com/26es8oag
https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php

1 KB
686 B

612ms
255ms

Document
text/html

162.0.229.33
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.33 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: littlechamps.school
Software: LiteSpeed /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-length: 542
content-type: text/html; charset=UTF-8
date: Mon, 24 Jul 2023 07:13:48 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0, public, s-max-age=900, stale-if-error: 86400
cf-cache-status: DYNAMIC
cf-ray: 7eba5cd278e9927a-FRA
content-type: text/html; charset=UTF-8
date: Mon, 24 Jul 2023 07:13:48 GMT
location: https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php
referrer-policy: unsafe-url
server: cloudflare
x-content-type-options: nosniff
x-tinyurl-redirect: eyJpdiI6IllVbW9PMWRKUlBnL1RWYkh6ZXBhSWc9PSIsInZhbHVlIjoiT0t4ZUVMdDdYY2MyRFc0NzErVWhTYmpnR2VVcGVZQWFxLzQxbTNQdEFoNEJ0ZGltR2JaYlc4NjZmVHIrQ3hsZyIsIm1hYyI6IjliOTNlNzNjMGY3MDYzYTYzMGYwYTQyM2YxMTg3ZjVjOWYwNDA5Y2I1YTRhMjliOGFkZGJjZTU4MTM2OTU1OGYiLCJ0YWciOiIifQ==
x-xss-protection: 1; mode=block

GET
H2 200 surgeries.php
quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/ 1 KB
756 B 701ms
701ms Document
text/html 162.0.229.33
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php
Requested by: Host: quraniceducation.online
URL: https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.229.33 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: littlechamps.school
Software: LiteSpeed /
Resource Hash

Request headers

Referer: https://quraniceducation.online/wp-content/plugins/jupiterx-core/includes/dashboard/widgets/surgeries.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-length: 613
content-type: text/html; charset=UTF-8
date: Mon, 24 Jul 2023 07:13:49 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H/1.1 200
OK Primary Request / Show response
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/ 89 KB
18 KB 382ms
286ms Document
text/html 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

b2d089ee251d150d36495fd02e865613e30907215948f52b6854eaabe72465e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17383
Content-Type: text/html; charset=UTF-8
Date: Mon, 24 Jul 2023 07:13:50 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK MarkWeb-latin-regular.woff2
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/ 15 KB
15 KB 218ms
215ms Font
font/woff2 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/MarkWeb-latin-regular.woff2

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
Origin: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:44:38 GMT
Server: nginx/1.14.2
ETag: "3b64-5f81af0e60d80"
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15204

GET
H/1.1 200
OK MarkWeb-latin-medium.woff2
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/ 15 KB
15 KB 272ms
200ms Font
font/woff2 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/MarkWeb-latin-medium.woff2

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
Origin: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:44:42 GMT
Server: nginx/1.14.2
ETag: "3a60-5f81af1231680"
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14944

GET
H/1.1 200
OK MarkWeb-latin-bold.woff2
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/ 15 KB
15 KB 295ms
224ms Font
font/woff2 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/MarkWeb-latin-bold.woff2

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

88f151f26d7582598781390eed26f60abfb543395da97d88c168e1f73a23b2f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
Origin: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:44:42 GMT
Server: nginx/1.14.2
ETag: "3c5c-5f81af1231680"
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15452

GET
H/1.1 200
OK styleguide-comdirect.css
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/style/ 1 MB
116 KB 290ms
222ms Stylesheet
text/css 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/style/styleguide-comdirect.css

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

441c9d9a45a0b0f65b4a4c11859e72414b4441bf03d7e03e42690b315effd3ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Thu, 30 Mar 2023 10:58:50 GMT
Server: nginx/1.14.2
ETag: "108d76-5f81bfa422e80-gzip"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes

GET
H/1.1 200
OK jquery-3.6.1.min.js Show response
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/js/ 114 KB
34 KB 285ms
213ms Script
application/javascript 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/js/jquery-3.6.1.min.js

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Tue, 14 Feb 2023 19:25:18 GMT
Server: nginx/1.14.2
ETag: "1c995-5f4adec81c380-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34232

GET
H/1.1 200
OK main.js Show response
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/js/ 1 KB
803 B 276ms
197ms Script
application/javascript 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/js/main.js

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

94bc68d20ce20d3053a3cd9a689f42c3c3b08ec927f462e907cdee096542c7a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:50 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Thu, 11 May 2023 08:57:24 GMT
Server: nginx/1.14.2
ETag: "4c8-5fb672d506500-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 431

POST
H/1.1 200
OK 8.php Show response
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/antibot8/ 0
441 B 218ms
217ms XHR
text/html 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/antibot8/8.php

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Mon, 24 Jul 2023 07:13:51 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: nginx/1.14.2
Access-Control-Allow-Methods: POST
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
X-Robots-Tag: noindex
Access-Control-Allow-Headers: *
Content-Length: 0
Expires: Thu, 18 Aug 1994 05:00:00 GMT

GET
H/1.1 200
OK svg-symbol.svg
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/ 220 KB
220 KB 214ms
214ms Other
image/svg+xml 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/fonts/svg-symbol.svg

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

92678f37c302748b47f4b34dfb341d184f21f5c74a0db3b19d072151325baf27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:51 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 05:40:34 GMT
Server: nginx/1.14.2
ETag: "37064-5f817880c5880"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 225380

GET
DATA 200
OK truncated
/ 797 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5405b0009161e617ee06548d437c8e9fa3a8ce3dafaca161024458ba907c1fc7

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 235 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H/1.1 200
OK Newsletter_512x560-1x.jpg
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/images/ 26 KB
26 KB 212ms
210ms Image
image/jpeg 185.193.89.7
ERISHENNYA-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/images/Newsletter_512x560-1x.jpg

Requested by

Host: kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
URL: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/

Protocol

HTTP/1.1

Server

185.193.89.7 , Russian Federation, ASN210950 (ERISHENNYA-ASN, UA),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

e294648a46772c4ff71c3a2f5ecf0ac264389eb1195d7bf75acacc9a4e456d00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Mon, 24 Jul 2023 07:13:51 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:50:04 GMT
Server: nginx/1.14.2
ETag: "6721-5f81b04546b00"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26401

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
quraniceducation.online/	1970-01-20 13:29:42	Name: d Value: 0
quraniceducation.online/	1970-01-20 13:29:42	Name: n Value: Etc/Unknown
quraniceducation.online/	1970-01-20 13:29:42	Name: sp Value: Win32
quraniceducation.online/	1970-01-20 13:29:42	Name: su Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/115.0.5790.102%20Safari/537.36
quraniceducation.online/	1970-01-20 13:29:42	Name: iu Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/115.0.5790.102%20Safari/537.36
quraniceducation.online/	1970-01-20 13:29:42	Name: wd Value: false
.kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/	1970-01-20 13:44:06	Name: antibot_8f660ff392d00ec89230c45c02529250 Value: 22b37f0a27511a5ec50cc7aac564b758-1690182829
kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: 88kfhbsn2o7a7on837113hn05h

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de
quraniceducation.online
tinyurl.com
162.0.229.33
185.193.89.7
2606:4700:10::6814:8b41
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970
441c9d9a45a0b0f65b4a4c11859e72414b4441bf03d7e03e42690b315effd3ef
5405b0009161e617ee06548d437c8e9fa3a8ce3dafaca161024458ba907c1fc7
88f151f26d7582598781390eed26f60abfb543395da97d88c168e1f73a23b2f3
92678f37c302748b47f4b34dfb341d184f21f5c74a0db3b19d072151325baf27
94bc68d20ce20d3053a3cd9a689f42c3c3b08ec927f462e907cdee096542c7a8
a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4
b2d089ee251d150d36495fd02e865613e30907215948f52b6854eaabe72465e2
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
e294648a46772c4ff71c3a2f5ecf0ac264389eb1195d7bf75acacc9a4e456d00
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de Open in urlscan Pro 185.193.89.7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

17 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

462 kBTransfer

1559 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

8 Cookies

Indicators

kunde-comdirect.de-id18bhfah2uj1irba8hf1bhabfm183012ba.com.de Open in urlscan Pro
185.193.89.7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

17 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

462 kB
Transfer

1559 kB
Size

8
Cookies

12 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!