blog.brandmandir.com Open in urlscan Pro
3.109.88.249 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/
Effective URL:
https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php
Submission: On October 02 via manual (October 2nd 2022, 2:32:31 am UTC) from IN — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 3.109.88.249, located in Mumbai, India and belongs to AMAZON-02, US. The main domain is blog.brandmandir.com.
TLS certificate: Issued by R3 on August 12th 2022. Valid for: 3 months.

This is the only time blog.brandmandir.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cornèr Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 19	3.109.88.249 3.109.88.249		16509 (AMAZON-02) (AMAZON-02)
18	1

19 3.109.88.249 (Mumbai, India) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-109-88-249.ap-south-1.compute.amazonaws.com

blog.brandmandir.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	brandmandir.com 1 redirects blog.brandmandir.com	178 KB
18	1

	Domain	Requested by
19	blog.brandmandir.com	1 redirects blog.brandmandir.com
18	1

This site contains no links.

Subject Issuer	Validity	Valid
blog.brandmandir.com R3	`2022-08-12` - `2022-11-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php
Frame ID: 29207D7B07547784FEDB48F60CDD15E9
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login: iCornèr | Cornèrcard | Onlineaccess

Page URL History Show full URLs

https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/ HTTP 302
https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

178 kB
Transfer

180 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/ HTTP 302
https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/ Redirect Chain https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/ https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php	7 KB 2 KB	6348ms 6329ms	Document text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `65be0c712aed423b5bd8c5808be88611ed0dec7e4e3d813550db6c9b9626e699` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Sun, 02 Oct 2022 02:32:25 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked Redirect headers Connection keep-alive Content-Type text/html; charset=UTF-8 Date Sun, 02 Oct 2022 02:32:19 GMT Location login.php Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET H/1.1	200 OK	bootstrap.min.css blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	150 KB 150 KB	243ms 242ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/bootstrap.min.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `6b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:25 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-2565e" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 153182 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	sticky-footer-navbar.css blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	517 B 837 B	359ms 119ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/sticky-footer-navbar.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `049bdf6dc57a3d1c9c8ef9ef365a6f4a9d6578eb3575158689ca50470f7bd52d` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-205" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 517 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	default.css blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	10 KB 10 KB	360ms 119ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/default.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `1629ec5904e3c812dbc09fda9276b81830cc2f38c89716035f72e171af54cbcb` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-2839" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 10297 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	icons.css blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	1 KB 2 KB	360ms 119ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/icons.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `5168ba395afb3dfed1e5c4cff8b0fbac7eb25783aef7006d66427a7ce0c53634` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-505" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 1285 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	ie7.css blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	761 B 1 KB	361ms 119ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/ie7.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `6a547cea69e8f714a913b8a2dbc490c481c29487f2fbb40490ae7eaedf6c5f2b` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-2f9" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 761 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	404 Not Found	jquery-3.3.1.min.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	361ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/jquery-3.3.1.min.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	jquery.inputmasked.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	480ms 119ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/jquery.inputmasked.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	jquery.cookie.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	481ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/jquery.cookie.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	momentjs.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	482ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/momentjs.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	bootstrap.min.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	481ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/bootstrap.min.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	validation.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	482ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/validation.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	common-translation.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	601ms 119ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/common-translation.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	default.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	602ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/default.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	logo.svg blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	11 KB 11 KB	122ms 122ms	Image image/svg+xml	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/logo.svg Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `c2109aa73f3cc71b61b8b05d859b51dfb603584277bcc33451f38e9343959cef` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-2a0a" Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 10762
GET H/1.1	200 OK	overlay.css blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	641 B 961 B	120ms 119ms	Stylesheet text/css	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/overlay.css Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash `c961216cf8b06f0abd85e6f30cfa59898072805f8274b817e4f2bc14aa338e6b` Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Last-Modified Fri, 23 Sep 2022 23:54:43 GMT Server nginx/1.18.0 (Ubuntu) ETag "632e4743-281" Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 641 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	404 Not Found	overlay.js blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	120ms 120ms	Script text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/overlay.js Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	404 Not Found	Roboto-Regular.ttf blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/	0 0	171ms 170ms	Font text/html	3.109.88.249 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/Roboto-Regular.ttf Requested by Host: blog.brandmandir.com URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/default.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.109.88.249 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-109-88-249.ap-south-1.compute.amazonaws.com Software nginx/1.18.0 (Ubuntu) / Resource Hash Request headers Referer https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/default.css Origin https://blog.brandmandir.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Date Sun, 02 Oct 2022 02:32:26 GMT Content-Encoding gzip Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection keep-alive Link <https://blog.brandmandir.com/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cornèr Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/jquery-3.3.1.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/jquery.inputmasked.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/jquery.cookie.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/bootstrap.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/momentjs.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/validation.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/common-translation.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/default.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/overlay.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://blog.brandmandir.com/wp-content/uploads/2022/09/erstattung/login_files/Roboto-Regular.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.brandmandir.com
3.109.88.249
049bdf6dc57a3d1c9c8ef9ef365a6f4a9d6578eb3575158689ca50470f7bd52d
1629ec5904e3c812dbc09fda9276b81830cc2f38c89716035f72e171af54cbcb
5168ba395afb3dfed1e5c4cff8b0fbac7eb25783aef7006d66427a7ce0c53634
65be0c712aed423b5bd8c5808be88611ed0dec7e4e3d813550db6c9b9626e699
6a547cea69e8f714a913b8a2dbc490c481c29487f2fbb40490ae7eaedf6c5f2b
6b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c
c2109aa73f3cc71b61b8b05d859b51dfb603584277bcc33451f38e9343959cef
c961216cf8b06f0abd85e6f30cfa59898072805f8274b817e4f2bc14aa338e6b

blog.brandmandir.com Open in urlscan Pro 3.109.88.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

178 kBTransfer

180 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

10 Console Messages

Indicators

blog.brandmandir.com Open in urlscan Pro
3.109.88.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

178 kB
Transfer

180 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!