urlscan.io logo urlscan.io
SecurityTrails logo

ci-t.de Open in urlscan Pro
178.254.15.201  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ci-t.de/wp-content/rz1714406064/app/login
Submission: On May 02 via manual from MA — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 178.254.15.201, located in Germany and belongs to EVANZOAS, DE. The main domain is ci-t.de.
TLS certificate: Issued by R3 on March 10th 2024. Valid for: 3 months.
This is the only time ci-t.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
2 13 178.254.15.201 42730 (EVANZOAS)
1 2a00:86c0:209... 40027 (NETFLIX-ASN)
13 3
Apex Domain
Subdomains		 Transfer
13 ci-t.de
ci-t.de
647 KB
1 nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 5898
72 KB
0 js-codes.com Failed
js-codes.com Failed
13 3
Domain Requested by
13 ci-t.de 2 redirects ci-t.de
1 assets.nflxext.com ci-t.de
0 js-codes.com Failed ci-t.de
13 3

This site contains no links.

Subject Issuer Validity Valid
www.ci-t.de
R3		 2024-03-10 -
2024-06-08		 3 months crt.sh
*.1.nflxso.net
DigiCert Secure Site ECC CA-1		 2024-04-04 -
2024-05-10		 a month crt.sh

This page contains 1 frames:

Primary Page: https://ci-t.de/wp-content/rz1714406064/app/login
Frame ID: 76319917AAC04A5D0F930A6BDC2ACEC5
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. https://ci-t.de/wp-content/rz1714406064/app/login HTTP 302
    https://ci-t.de/wp-content/rz1714406064/app/index HTTP 302
    https://ci-t.de/wp-content/rz1714406064/app/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

92 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

719 kB
Transfer

998 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ci-t.de/wp-content/rz1714406064/app/login HTTP 302
    https://ci-t.de/wp-content/rz1714406064/app/index HTTP 302
    https://ci-t.de/wp-content/rz1714406064/app/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
ci-t.de/wp-content/rz1714406064/app/
Redirect Chain
  • https://ci-t.de/wp-content/rz1714406064/app/login
  • https://ci-t.de/wp-content/rz1714406064/app/index
  • https://ci-t.de/wp-content/rz1714406064/app/login
906 B
542 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
3817d4f1a7c1bdcd01e1cbeea1839508409a329c53334e12d05c7b580f5a7f6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
469
content-type
text/html; charset=UTF-8
date
Thu, 02 May 2024 02:48:46 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Thu, 02 May 2024 02:48:45 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
login
pragma
no-cache
server
Apache
strict-transport-security
max-age=31536000
none.css
ci-t.de/wp-content/rz1714406064/app/style/ 		119 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/style/none.css
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
ebed425ce97fd847ea4a8b5c00c79a3be333247972a72755dd26af0bf7250152
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 02 May 2024 02:48:46 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"1db6d-6176fa1697479-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
19946
none2.css
ci-t.de/wp-content/rz1714406064/app/style/ 		134 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/style/none2.css
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
5cfce24261211668d5db5a01c4fcdae60852d01faa05b325ee63410280c7221d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 02 May 2024 02:48:46 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"216ca-6176fa1697479-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
23331
modernizr.min.js
js-codes.com/modernizr/2.8.7/ 		0
0
jquery.js
ci-t.de/wp-content/rz1714406064/app/js/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/js/jquery.js
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 02 May 2024 02:48:46 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"15339-6176fa1694598-gzip"
vary
Accept-Encoding
content-type
text/javascript
accept-ranges
bytes
content-length
30248
jquery.ccvalid.js
ci-t.de/wp-content/rz1714406064/app/js/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/js/jquery.ccvalid.js
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 02 May 2024 02:48:46 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"1d12-6176fa1694598-gzip"
vary
Accept-Encoding
content-type
text/javascript
accept-ranges
bytes
content-length
1912
jquery.mask.js
ci-t.de/wp-content/rz1714406064/app/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/js/jquery.mask.js
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 02 May 2024 02:48:46 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"1fad-6176fa1694598-gzip"
vary
Accept-Encoding
content-type
text/javascript
accept-ranges
bytes
content-length
3346
step3.php
ci-t.de/wp-content/rz1714406064/workshop/stockers/ 		7 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/workshop/stockers/step3.php
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/js/jquery.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
c6f34b992f7f54461f4daea361365f82be669a974b78d8766687eeb5b167796e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 02 May 2024 02:48:46 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
2238
expires
Thu, 19 Nov 1981 08:52:00 GMT
favicon.ico
ci-t.de/wp-content/rz1714406064/app/pic/ 		17 KB
17 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ci-t.de/wp-content/rz1714406064/app/pic/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 02 May 2024 02:48:46 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"423e-6176fa16964d9"
content-type
image/vnd.microsoft.icon
accept-ranges
bytes
content-length
16958
bg.jpg
ci-t.de/wp-content/rz1714406064/app/pic/ 		547 KB
547 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ci-t.de/wp-content/rz1714406064/app/pic/bg.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
3bfea431fa8fae777b38a1787995122960810fbda1b31c9d4df1cee97850caf0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 02 May 2024 02:48:47 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"88bf6-6176fa1695538"
content-type
image/jpeg
accept-ranges
bytes
content-length
560118
logo.svg
ci-t.de/wp-content/rz1714406064/app/pic/ 		864 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ci-t.de/wp-content/rz1714406064/app/pic/logo.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 02 May 2024 02:48:47 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"360-6176fa16964d9"
content-type
image/svg+xml
accept-ranges
bytes
content-length
864
fb.png
ci-t.de/wp-content/rz1714406064/app/pic/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ci-t.de/wp-content/rz1714406064/app/pic/fb.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
178.254.15.201 , Germany, ASN42730 (EVANZOAS, DE),
Reverse DNS
sh-74.1blu.de
Software
Apache /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/wp-content/rz1714406064/app/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 02 May 2024 02:48:47 GMT
last-modified
Thu, 02 May 2024 02:47:57 GMT
server
Apache
etag
"5af-6176fa16964d9"
content-type
image/png
accept-ranges
bytes
content-length
1455
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by
Host: ci-t.de
URL: https://ci-t.de/wp-content/rz1714406064/app/style/none.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ci-t.de/
Origin
https://ci-t.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 02 May 2024 02:48:47 GMT
Last-Modified
Mon, 29 Jan 2018 01:50:51 GMT
Server
nginx
Content-MD5
fPYVbMSBJEtaJUNi17c/AA==
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73572
Expires
Thu, 09 May 2024 02:48:48 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
js-codes.com
URL
https://js-codes.com/modernizr/2.8.7/modernizr.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| $jscomp function| isEmail

1 Cookies

Domain/Path Name / Value
ci-t.de/ Name: PHPSESSID
Value: bf53dfd77ea7f28c9843aee67af50040

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://ci-t.de/wp-content/rz1714406064/app/login
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000