lngdirects.4lima.de Open in urlscan Pro
2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lngdirects.4lima.de/es768/AB_3500a1/
Submission: On May 20 via automatic, source openphish (May 20th 2019, 5:02:21 pm UTC)

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2a00:f48:2000:affe::50, located in Germany and belongs to TTM, DE. The main domain is lngdirects.4lima.de.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 20th 2019. Valid for: 3 months.

This is the only time lngdirects.4lima.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address		AS Autonomous System
14	2a00:f48:2000... 2a00:f48:2000:affe::50		47447 (TTM) (TTM)
14	1

14 2a00:f48:2000:affe::50 (Germany)

ASN47447 (TTM, DE)

lngdirects.4lima.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	4lima.de lngdirects.4lima.de	590 KB
14	1

	Domain	Requested by
14	lngdirects.4lima.de	lngdirects.4lima.de
14	1

This site contains links to these domains. Also see Links.

Domain
ing.ingdirect.es

Subject Issuer	Validity	Valid
lngdirects.4lima.de Let's Encrypt Authority X3	`2019-05-20` - `2019-08-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lngdirects.4lima.de/es768/AB_3500a1/
Frame ID: 64CB13AF9E3DA42C2997708FD0506D44
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

590 kB
Transfer

3677 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://ing.ingdirect.es/W/Transactional/adf/images/sobre-ing/cookies_transaccional.html
Title: Política de cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
lngdirects.4lima.de/es768/AB_3500a1/ 34 KB
8 KB 17ms
17ms Document
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

d87bbf44171bd10ecac940b718dd151190afad1f21981bcce250a927eea5bb1c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

:method: GET
:authority: lngdirects.4lima.de
:scheme: https
:path: /es768/AB_3500a1/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: openresty
date: Mon, 20 May 2019 17:02:04 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding
x-lima-id: heHQZdYNfecqFFsFjh
set-cookie: _lcp=a; Path=/; expires=Mon Mar 20 2034 13:02:58
content-security-policy: upgrade-insecure-requests
x-powered-by: PHP/7.1.29
content-encoding: gzip

GET
H2 404 s23984268574907
lngdirects.4lima.de/es768/content/ 0
0 124ms
122ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/s23984268574907

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heVIhGPnz41O3SJ1lw
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 transactional.css
lngdirects.4lima.de/es768/content/ 3 MB
457 KB 15ms
13ms Stylesheet
text/css 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/transactional.css

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

478ef9dee9f0fdd1c9e27a4e9852be164f52cd19dd1bd0b48f5a695f6666f883

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: W/"368faa-58951eed75900"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
status: 200
x-lima-id: he93nd91ted1SdJsaD
content-security-policy: upgrade-insecure-requests
expires: Wed, 19 Jun 2019 17:02:04 GMT

GET
H2 404 utag_003.js
lngdirects.4lima.de/es768/content/ 0
0 122ms
121ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/utag_003.js

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heW0jtzT2DDhaaSqiO
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 GlobalConfiguration.js
lngdirects.4lima.de/es768/content/ 0
0 125ms
123ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/GlobalConfiguration.js

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heOb70vPjk43DutD39
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 404 login.js
lngdirects.4lima.de/es768/content/ 0
0 126ms
124ms Script
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to

Full URL

https://lngdirects.4lima.de/es768/content/login.js

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: hejJEuo5PWBsNgsoAS
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 logoING.svg
lngdirects.4lima.de/es768/content/ 33 KB
13 KB 15ms
14ms Image
image/svg+xml 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/logoING.svg

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
etag: W/"84d7-58951eed75900"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-lima-id: heXztB01mxWaA8sMmO
content-security-policy: upgrade-insecure-requests

GET
H2 200 phone.png
lngdirects.4lima.de/es768/content/ 416 B
677 B 17ms
16ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/phone.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

8bc3bec9b0f346f723e2753d31e93fb41afcf1972cc8daad655351a6ad3021f6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: "1a0-58951eed75900"
content-type: image/png
status: 200
x-lima-id: he8jOLn0TDuwVrvP9l
date: Mon, 20 May 2019 17:02:04 GMT
accept-ranges: bytes
content-length: 416
expires: Wed, 19 Jun 2019 17:02:04 GMT

GET
H2 200 personne.png
lngdirects.4lima.de/es768/content/ 605 B
866 B 16ms
15ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/personne.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

03e1c85358fea7b541ec9f8d6bc04370ded1448be28a6653e68468cc843e23cb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: "25d-58951eed75900"
content-type: image/png
status: 200
x-lima-id: he6AoxlBRgxN7UL4RS
date: Mon, 20 May 2019 17:02:04 GMT
accept-ranges: bytes
content-length: 605
expires: Wed, 19 Jun 2019 17:02:04 GMT

GET
H2 200 ques.png
lngdirects.4lima.de/es768/content/ 589 B
849 B 13ms
12ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/ques.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

8043a1b31bff270226472acf0f69c9bf2287203b8581cfcd566a01e3d34df461

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: "24d-58951eed75900"
content-type: image/png
status: 200
x-lima-id: hesZieEud4r0rtD9vE
date: Mon, 20 May 2019 17:02:04 GMT
accept-ranges: bytes
content-length: 589
expires: Wed, 19 Jun 2019 17:02:04 GMT

GET
H2 200 norton-logo.png
lngdirects.4lima.de/es768/content/ 8 KB
9 KB 15ms
13ms Image
image/png 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/norton-logo.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

9333473effc6bced92f7eb03baefe1cfb2075e28298c0c0ce930c8fe915365b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
cache-control: max-age=2592000
etag: "20f8-58951eed75900"
content-type: image/png
status: 200
x-lima-id: hexNBWQys3foibKZlM
date: Mon, 20 May 2019 17:02:04 GMT
accept-ranges: bytes
content-length: 8440
expires: Wed, 19 Jun 2019 17:02:04 GMT

GET
H2 200 LogoDNIE-trazado.svg
lngdirects.4lima.de/es768/content/ 13 KB
5 KB 14ms
13ms Image
image/svg+xml 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/LogoDNIE-trazado.svg

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 13:44:36 GMT
server: openresty
etag: W/"32db-58951eed75900"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
x-lima-id: heiRKQEHwDJBcUI3DD
content-security-policy: upgrade-insecure-requests

GET
H2 404 footerimg.png
lngdirects.4lima.de/es768/content/ 9 KB
9 KB 78ms
77ms Image
text/html 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/footerimg.png

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty / PHP/7.1.29

Resource Hash

c28618c3a91f4c2da0521a8f24a6e2b17c538d0580bcce641f82f0196112a2e4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/AB_3500a1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 20 May 2019 17:02:04 GMT
content-encoding: gzip
server: openresty
cache-control: no-cache, must-revalidate, max-age=0
x-powered-by: PHP/7.1.29
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
x-lima-id: heldlYWMCRgdK0QaLS
content-security-policy: upgrade-insecure-requests
link: <https://lngdirects.4lima.de/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 banner-login_1164x300.jpg
lngdirects.4lima.de/es768/content/ 87 KB
87 KB 9ms
9ms Image
image/jpeg 2a00:f48:2000:affe::50
TTM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lngdirects.4lima.de/es768/content/banner-login_1164x300.jpg

Requested by

Host: lngdirects.4lima.de
URL: https://lngdirects.4lima.de/es768/AB_3500a1/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),

Reverse DNS

Software

openresty /

Resource Hash

6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://lngdirects.4lima.de/es768/content/transactional.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests
last-modified: Mon, 20 May 2019 13:44:08 GMT
server: openresty
cache-control: max-age=2592000
etag: "15ad7-58951ed2c1a00"
content-type: image/jpeg
status: 200
x-lima-id: heXfAibYUsi7cgDosm
date: Mon, 20 May 2019 17:02:05 GMT
accept-ranges: bytes
content-length: 88791
expires: Wed, 19 Jun 2019 17:02:05 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lngdirects.4lima.de/	1970-01-24 10:54:32	Name: _lcp2 Value: a
			lngdirects.4lima.de/	1970-01-24 10:54:32	Name: _lcp Value: a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lngdirects.4lima.de
2a00:f48:2000:affe::50
03e1c85358fea7b541ec9f8d6bc04370ded1448be28a6653e68468cc843e23cb
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
478ef9dee9f0fdd1c9e27a4e9852be164f52cd19dd1bd0b48f5a695f6666f883
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
8043a1b31bff270226472acf0f69c9bf2287203b8581cfcd566a01e3d34df461
8bc3bec9b0f346f723e2753d31e93fb41afcf1972cc8daad655351a6ad3021f6
9333473effc6bced92f7eb03baefe1cfb2075e28298c0c0ce930c8fe915365b0
c28618c3a91f4c2da0521a8f24a6e2b17c538d0580bcce641f82f0196112a2e4
d87bbf44171bd10ecac940b718dd151190afad1f21981bcce250a927eea5bb1c

lngdirects.4lima.de Open in urlscan Pro 2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

590 kBTransfer

3677 kBSize

2 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

lngdirects.4lima.de Open in urlscan Pro
2a00:f48:2000:affe::50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

590 kB
Transfer

3677 kB
Size

2
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!