fl-coder.de
Open in
urlscan Pro
185.194.237.74
Malicious Activity!
Public Scan
Submitted URL: http://fl-coder.de/.data/.data/
Effective URL: http://fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/?newsid=1103708187YmFmY2RhMzYwY2Y5MDE2NjF...
Submission: On June 04 via manual from US
Effective URL: http://fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/?newsid=1103708187YmFmY2RhMzYwY2Y5MDE2NjF...
Submission: On June 04 via manual from US
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 7 HTTP transactions.
The main IP is 185.194.237.74, located in
Germany and
belongs to ACCELERATED-IT, DE.
The main domain is fl-coder.de.
This is the only time fl-coder.de was scanned on urlscan.io!
This is the only time fl-coder.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 185.194.237.74 185.194.237.74 | 31400 (ACCELERAT...) (ACCELERATED-IT) | |
| 1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
| 7 | 3 |
5
185.194.237.74
(Germany)
ASN31400 (ACCELERATED-IT, DE)
PTR: web19.premium-webspace.net
ASN31400 (ACCELERATED-IT, DE)
PTR: web19.premium-webspace.net
| fl-coder.de |
1
205.185.208.52
(Phoenix, United States)
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
| code.jquery.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
fl-coder.de
fl-coder.de |
285 KB |
| 1 |
jquery.com
code.jquery.com |
33 KB |
| 0 |
microsoftonline-p.com
Failed
secure.aadcdn.microsoftonline-p.com Failed |
|
| 7 | 3 |
| Domain | Requested by | |
|---|---|---|
| 5 | fl-coder.de |
fl-coder.de
|
| 1 | code.jquery.com |
fl-coder.de
|
| 0 | secure.aadcdn.microsoftonline-p.com Failed |
fl-coder.de
|
| 7 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/?newsid=1103708187YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=&loginpage=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=&reff=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=
Frame ID: A35BCB6B93D2257ED73EDBDE3259E099
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://fl-coder.de/.data/.data/ Page URL
- http://fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/?newsid=1103708187YmF... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://fl-coder.de/.data/.data/ Page URL
- http://fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/?newsid=1103708187YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=&loginpage=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=&reff=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc=YmFmY2RhMzYwY2Y5MDE2NjFjYjdiNzBiNTEyZDMxYjc= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
fl-coder.de/.data/.data/ |
630 B 581 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow_left.svg
fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/ |
513 B 787 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.11.3.min.js
code.jquery.com/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.jpg
fl-coder.de/.data/.data/cmd-login=652a78570f5044ca3761e9c59247e10a/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secure.aadcdn.microsoftonline-p.com
- URL
- https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| showhide0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fl-coder.de
secure.aadcdn.microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com
185.194.237.74
205.185.208.52
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34a5499818da1cac5072cfddf0b2c717288c198b18a410b1937aa2481aef1d6d
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
fca7759a981b0582bdcc8c5c8a3d0af0313801c4af4967ee3b0dc1e355e67cf6