starte-ueberpruefung.com Open in urlscan Pro
81.29.143.155  Malicious Activity! Public Scan

Submitted URL: http://starte-ueberpruefung.com/
Effective URL: https://starte-ueberpruefung.com/
Submission: On November 16 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 81.29.143.155, located in Russian Federation and belongs to IMAQLIQ iqdata.center, RU. The main domain is starte-ueberpruefung.com.
TLS certificate: Issued by R3 on November 15th 2022. Valid for: 3 months.
This is the only time starte-ueberpruefung.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online) Amazon Japan (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 81.29.143.155 12555 (IMAQLIQ i...)
2 2
Apex Domain
Subdomains
Transfer
2 starte-ueberpruefung.com
starte-ueberpruefung.com
272 KB
0 cloudflare.com Failed
cdnjs.cloudflare.com Failed
2 2
Domain Requested by
2 starte-ueberpruefung.com 1 redirects
0 cdnjs.cloudflare.com Failed starte-ueberpruefung.com
2 2

This site contains no links.

Subject Issuer Validity Valid
starte-ueberpruefung.com
R3
2022-11-15 -
2023-02-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://starte-ueberpruefung.com/
Frame ID: C0BA1B5E4277137F1BB9F15006D7B0D0
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Amazon Anmelden

Page URL History Show full URLs

  1. http://starte-ueberpruefung.com/ HTTP 301
    https://starte-ueberpruefung.com/ Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

304 kB
Transfer

561 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://starte-ueberpruefung.com/ HTTP 301
    https://starte-ueberpruefung.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
starte-ueberpruefung.com/
Redirect Chain
  • http://starte-ueberpruefung.com/
  • https://starte-ueberpruefung.com/
391 KB
272 KB
Document
General
Full URL
https://starte-ueberpruefung.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.29.143.155 , Russian Federation, ASN12555 (IMAQLIQ iqdata.center, RU),
Reverse DNS
himby.termweek.com
Software
nginx /
Resource Hash
25c6dcbbc71c851b7ab09af0aff0b159c9e5b641bf4e45eeb02119aa3992cba7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 16 Nov 2022 01:32:54 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked

Redirect headers

Connection
close
Content-Length
178
Content-Type
text/html
Date
Wed, 16 Nov 2022 01:32:53 GMT
Location
https://starte-ueberpruefung.com/
Server
nginx
truncated
/
20 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3b48af9153e92423d79f2d3bdc3e0b15e482ceb87e5c3ce3af5bd6f593cead9d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
60 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
58 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2ce18237ee8094ab137b910ce33aa1cdd7904c1dad5f238734ad5e307c5be08b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
16 KB
16 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Request headers

Referer
Origin
https://starte-ueberpruefung.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/font-woff2
truncated
/
16 KB
16 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89

Request headers

Referer
Origin
https://starte-ueberpruefung.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/font-woff2
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cdnjs.cloudflare.com
URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online) Amazon Japan (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
starte-ueberpruefung.com/ Name: PHPSESSID
Value: paersahp6hchkn5bmoceaacad7

1 Console Messages

Source Level URL
Text
security error URL: https://starte-ueberpruefung.com/
Message:
Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' data:". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.