www.abgleichdatenguide.info
Open in
urlscan Pro
2606:4700:30::681b:a187
Malicious Activity!
Public Scan
Submission: On November 19 via automatic, source phishtank
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 15th 2018. Valid for: a year.
This is the only time www.abgleichdatenguide.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commerzbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2606:4700:30:... 2606:4700:30::681b:a187 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
5 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.abgleichdatenguide.info |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
abgleichdatenguide.info
www.abgleichdatenguide.info |
159 KB |
5 | 1 |
Domain | Requested by | |
---|---|---|
5 | www.abgleichdatenguide.info |
www.abgleichdatenguide.info
|
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2018-11-15 - 2019-11-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.abgleichdatenguide.info/7gCVF68m62kV7pUq/fhaNmbzK42cvdPBP.php
Frame ID: 2A67863F29EC693D0AE1006C88CD80D0
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /cloudflare/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
fhaNmbzK42cvdPBP.php
www.abgleichdatenguide.info/7gCVF68m62kV7pUq/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.php
www.abgleichdatenguide.info/7gCVF68m62kV7pUq/dist/sheet/ |
482 KB 124 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_big_svg.svg
www.abgleichdatenguide.info/7gCVF68m62kV7pUq/dist/images/ |
17 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mtnav.gif
www.abgleichdatenguide.info/7gCVF68m62kV7pUq/dist/images/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons_woff.woff
www.abgleichdatenguide.info/7gCVF68m62kV7pUq/dist/fonts/ |
40 KB 25 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commerzbank (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.abgleichdatenguide.info/ | Name: PHPSESSID Value: hhds6ja539bl4im9qp2n60jgc2 |
|
.abgleichdatenguide.info/ | Name: __cfduid Value: d7f036ad837e52b0d53297e9e703769a91542589353 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.abgleichdatenguide.info
2606:4700:30::681b:a187
5395112d6363feff3fa1437568893c9a448b50fc6db0ab4537a0006f28781152
8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75
ae247f0ee2d331e7f89a54b2d683589de735b83bda69b00b29bf728e1cc31e75
b52db98725cfebc3ea28099617bd8ec31fe8fb5cf63d8d30d1c375fd64c19876
b78c99a9a76fbd0be42cca42783515efad40604bdaa941739f753d7141b3b5f2
d28263b118f646cc7c098e5b8c09f994fe27585f541a90f02423b9246621c0d2