dfmistudents.com Open in urlscan Pro
198.102.8.48 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dfmistudents.com/wp-includes/certificates/badi/web/S.php
Effective URL:
https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Submission: On February 18 via manual (February 18th 2022, 9:29:10 am UTC) from SE — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 198.102.8.48, located in United States and belongs to KVCNET-2009, US. The main domain is dfmistudents.com.
TLS certificate: Issued by R3 on February 9th 2022. Valid for: 3 months.

This is the only time dfmistudents.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	198.102.8.48 198.102.8.48	395111 (KVCNET-2009) (KVCNET-2009)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
13	4

9 198.102.8.48 (United States)

ASN395111 (KVCNET-2009, US)
PTR: ok1051.kvchosting.com

dfmistudents.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dfmistudents.com dfmistudents.com	431 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 197	5 KB
1	gstatic.com fonts.gstatic.com	31 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
13	4

	Domain	Requested by
9	dfmistudents.com	dfmistudents.com
2	cdnjs.cloudflare.com	dfmistudents.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	dfmistudents.com
13	4

This site contains no links.

Subject Issuer	Validity	Valid
www.dfmistudents.ladtem.org R3	`2022-02-09` - `2022-05-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-07` - `2022-05-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Frame ID: 063E70751D85F5F5880126E61E5A6C76
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home - Brand

Page URL History Show full URLs

https://dfmistudents.com/wp-includes/certificates/badi/web/S.php Page URL
https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

468 kB
Transfer

483 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://dfmistudents.com/wp-includes/certificates/badi/web/S.php Page URL
https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK S.php Show response
dfmistudents.com/wp-includes/certificates/badi/web/ 46 B
489 B 491ms
143ms Document
text/html 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/S.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: 8543b2b938cede5e2b2053c4f3d6d71c617f3ac20bfa62092432de7cdf36f399

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 18 Feb 2022 09:29:05 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request wait.php Show response
dfmistudents.com/wp-includes/certificates/badi/web/ 3 KB
1 KB 129ms
128ms Document
text/html 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/S.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: d5dfae146abd786e54e95965b9bc098be09f86c084c8ce5d6ebde5b42d892f5e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/S.php

Response headers

Date: Fri, 18 Feb 2022 09:29:05 GMT
Server: Apache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK bootstrap.min.css
dfmistudents.com/wp-includes/certificates/badi/web/assets/bootstrap/css/ 182 KB
183 KB 127ms
126ms Stylesheet
text/css 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/assets/bootstrap/css/bootstrap.min.css
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: 61fcaf60ecdf8d6b29bdc104701cdedfe094c6341c96b3a7d676fdc2bfd1db06

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:05 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 186728

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 131ms
47ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,400i,700,700i,600,600i

Requested by

Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

43d94b781213c9565346c55d4a7e41a54f4db95ec9618bd5c30d3755bdf72688

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 09:13:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 18 Feb 2022 09:29:05 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 18 Feb 2022 09:29:05 GMT

GET
H2 200 baguetteBox.min.css
cdnjs.cloudflare.com/ajax/libs/baguettebox.js/1.10.0/ 4 KB
2 KB 47ms
30ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/baguettebox.js/1.10.0/baguetteBox.min.css

Requested by

Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16a0b33679f25e5e47c4731d6fe450fd157f5fb7ea7cf710632f86da014bdd79

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 09:29:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 47571
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 804
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:06:10 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03d72-e19"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4G3lEwvEox7qKSjDvm2AtH3AcN4ePnml%2BL4axyfg8ya2FSPKL1O2VN2umZqrLWyqRJFYl54wCd4Yp%2FqLtk49Q7Mtf4lYeQhQSHf29Fyw7KNTvxQeACe97Lh9ibuX3oXUCnVZ8BvES%2Fm1vmPnF8OyZzfe"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6df63aa3697a691f-FRA
expires: Wed, 08 Feb 2023 09:29:05 GMT

GET
H/1.1 200
OK styles.min.css
dfmistudents.com/wp-includes/certificates/badi/web/assets/css/ 500 B
741 B 364ms
123ms Stylesheet
text/css 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/assets/css/styles.min.css
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: ea7d0e26556f5b72b0223547446bafc52347ec0b29cd27ea254cb0e37542e962

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:06 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 500

GET
H/1.1 200
OK nem.png
dfmistudents.com/wp-includes/certificates/badi/web/assets/img/ 21 KB
22 KB 377ms
126ms Image
image/png 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/assets/img/nem.png
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: a7581fd24cd207ad4fe6c148a5979a2ceef1da3d83f0a6c4f59d9bb6e080d4c8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:06 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 21893

GET
H/1.1 200
OK wait.gif
dfmistudents.com/wp-includes/certificates/badi/web/ 78 KB
78 KB 381ms
126ms Image
image/gif 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.gif
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: 510b6971d07b034683f0a89b69204ce097f00520c4cdc568994faf754ae0a458

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:06 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 79834

GET
H/1.1 200
OK bootstrap.min.js Show response
dfmistudents.com/wp-includes/certificates/badi/web/assets/bootstrap/js/ 77 KB
77 KB 364ms
123ms Script
application/javascript 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/assets/bootstrap/js/bootstrap.min.js
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: 79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:06 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 78748

GET
H2 200 baguetteBox.min.js Show response
cdnjs.cloudflare.com/ajax/libs/baguettebox.js/1.10.0/ 9 KB
3 KB 48ms
31ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/baguettebox.js/1.10.0/baguetteBox.min.js

Requested by

Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

950ad61fa50fb4d949511b4460280a0ea2f206c7076bfb85fe71657bd6f1ded2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 18 Feb 2022 09:29:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7999130
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3003
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:06:10 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03d72-23fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1n%2FeHR8qxOXMARg%2BdF1LRd1vNoB%2F9dlz%2FNoxgyTzMqJJl3%2B7KGWiiJPc6aYy%2BDrpFJ9Z4TF6GXqGEfWyoU5ipqbUAChG6XI1YTbvg5NJlM2gBxLZiItZCMjcXCENWjIEM6sgZ%2Fce5f5abIrsJNxPD2yK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6df63aa3797e691f-FRA
expires: Wed, 08 Feb 2023 09:29:05 GMT

GET
H/1.1 200
OK script.min.js Show response
dfmistudents.com/wp-includes/certificates/badi/web/assets/js/ 2 KB
2 KB 369ms
123ms Script
application/javascript 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/assets/js/script.min.js
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: 939d045d26d11b2d2a71d5ed22294343daabe31a6f4b65205c903b448ab520df

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:06 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1566

GET
H/1.1 200
OK header.jpg
dfmistudents.com/wp-includes/certificates/badi/web/assets/img/ 67 KB
67 KB 128ms
128ms Image
image/jpeg 198.102.8.48
KVCNET-2009

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dfmistudents.com/wp-includes/certificates/badi/web/assets/img/header.jpg
Requested by: Host: dfmistudents.com
URL: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 198.102.8.48 , United States, ASN395111 (KVCNET-2009, US),
Reverse DNS: ok1051.kvchosting.com
Software: Apache /
Resource Hash: 836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dfmistudents.com/wp-includes/certificates/badi/web/wait.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 18 Feb 2022 09:29:06 GMT
Last-Modified: Thu, 17 Feb 2022 14:26:49 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 68419

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v23/ 30 KB
31 KB 119ms
36ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v23/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,400i,700,700i,600,600i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://dfmistudents.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 08:55:44 GMT
x-content-type-options: nosniff
age: 174802
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30876
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 00:11:59 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Feb 2023 08:55:44 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dfmistudents.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 82d72929c1d16242edef00562c63128b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
dfmistudents.com
fonts.googleapis.com
fonts.gstatic.com
198.102.8.48
2606:4700::6810:125e
2a00:1450:4001:810::2003
2a00:1450:4001:830::200a
16a0b33679f25e5e47c4731d6fe450fd157f5fb7ea7cf710632f86da014bdd79
43d94b781213c9565346c55d4a7e41a54f4db95ec9618bd5c30d3755bdf72688
510b6971d07b034683f0a89b69204ce097f00520c4cdc568994faf754ae0a458
61fcaf60ecdf8d6b29bdc104701cdedfe094c6341c96b3a7d676fdc2bfd1db06
79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
8543b2b938cede5e2b2053c4f3d6d71c617f3ac20bfa62092432de7cdf36f399
939d045d26d11b2d2a71d5ed22294343daabe31a6f4b65205c903b448ab520df
950ad61fa50fb4d949511b4460280a0ea2f206c7076bfb85fe71657bd6f1ded2
a7581fd24cd207ad4fe6c148a5979a2ceef1da3d83f0a6c4f59d9bb6e080d4c8
c8f7c04f8d691138d54380550d91349271ca19cfc0f3f6666c401cfa892a12f8
d5dfae146abd786e54e95965b9bc098be09f86c084c8ce5d6ebde5b42d892f5e
ea7d0e26556f5b72b0223547446bafc52347ec0b29cd27ea254cb0e37542e962

dfmistudents.com Open in urlscan Pro 198.102.8.48 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

468 kBTransfer

483 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

dfmistudents.com Open in urlscan Pro
198.102.8.48 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

468 kB
Transfer

483 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!