regupdates-germande.org
Open in
urlscan Pro
2400:cb00:2048:1::6818:165b
Malicious Activity!
Public Scan
Submission: On December 18 via automatic, source openphish
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on December 15th 2017. Valid for: 6 months.
This is the only time regupdates-germande.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2400:cb00:204... 2400:cb00:2048:1::6818:165b | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 151.139.237.113 151.139.237.113 | 54104 (AS-STACKPATH) (AS-STACKPATH - netDNA) | |
6 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
regupdates-germande.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
regupdates-germande.org
regupdates-germande.org |
66 KB |
1 |
jquery.com
code.jquery.com |
38 KB |
6 | 2 |
Domain | Requested by | |
---|---|---|
5 | regupdates-germande.org |
regupdates-germande.org
code.jquery.com |
1 | code.jquery.com |
regupdates-germande.org
|
6 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl370868.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2017-12-15 - 2018-06-23 |
6 months | crt.sh |
code.jquery.com AlphaSSL CA - SHA256 - G2 |
2017-07-25 - 2018-07-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://regupdates-germande.org/12315/cnUkJqewhMRdK89/1xohs3JNZ4PR2ep/1000000000/VWaDKy1GPLgswnF/0xbj9U3via8JHOn/anmeldung.handle.php?assoc_handle=Uvkos&openid_claim=MgmUu&identifier_select=h94pM&pape_max=s0HfV
Frame ID: (D69FB6E92459D22D771F14B17377C3C)
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
anmeldung.handle.php
regupdates-germande.org/12315/cnUkJqewhMRdK89/1xohs3JNZ4PR2ep/1000000000/VWaDKy1GPLgswnF/0xbj9U3via8JHOn/ |
8 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eb250580d6759e6f8f5aa7179debc59d2.css
regupdates-germande.org/12315/cnUkJqewhMRdK89/1xohs3JNZ4PR2ep/1000000000/VWaDKy1GPLgswnF/0xbj9U3via8JHOn/src/css/ |
130 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5e94f1e067b7539e6b328414233d3f163.css
regupdates-germande.org/12315/cnUkJqewhMRdK89/1xohs3JNZ4PR2ep/1000000000/VWaDKy1GPLgswnF/0xbj9U3via8JHOn/src/css/ |
31 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.0.min.js
code.jquery.com/ |
94 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a.js
regupdates-germande.org/12315/cnUkJqewhMRdK89/1xohs3JNZ4PR2ep/1000000000/VWaDKy1GPLgswnF/0xbj9U3via8JHOn/src/js/ |
46 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite_img.png
regupdates-germande.org/12315/cnUkJqewhMRdK89/1xohs3JNZ4PR2ep/1000000000/VWaDKy1GPLgswnF/0xbj9U3via8JHOn/src/img/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint function| $ function| jQuery object| deployJava function| Detector function| murmurhash3_32_gc object| swfobject function| ClientJS function| UAParser2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
regupdates-germande.org/ | Name: PHPSESSID Value: blrue39o8t375tb6rslrpecl83 |
|
.regupdates-germande.org/ | Name: __cfduid Value: d933da402eb56d3f3d5de4e391d4a22681513571338 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
regupdates-germande.org
151.139.237.113
2400:cb00:2048:1::6818:165b
3425e9036117199702c5eea1bec0a4cecc8b779edae5e4870e688d67d12ac71a
3b000a593bc76d14bd50035e94493fafbecd92d2bd47fc957e98acdb4b860c01
591c48a161f91ce005b11fa41df8645cff1859ae842c615dbcf929cd8ee108f8
ad723e06914eb47b2a01bfb2ac8e0eec1a190300fc188f51a40d94a31bedc141
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
d1357a46dfc240c97d783ea3dcd220c56769703e0a1218d1e0fff2736b18d2cf