kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de Open in urlscan Pro
91.215.85.230 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://newshell.perpussdrahmat.my.id/com/feasibility/
Effective URL:
https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
Submission: On July 25 via manual (July 25th 2023, 8:41:33 am UTC) from DE — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 91.215.85.230, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de.
TLS certificate: Issued by R3 on July 25th 2023. Valid for: 3 months.

This is the only time kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	91.215.85.228 91.215.85.228	200593 (PROSPERO-AS) (PROSPERO-AS)
9	91.215.85.230 91.215.85.230	200593 (PROSPERO-AS) (PROSPERO-AS)
12	3

2 91.215.85.228 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)

newshell.perpussdrahmat.my.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 91.215.85.230 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)

kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	com.de kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de	460 KB
2	perpussdrahmat.my.id newshell.perpussdrahmat.my.id	3 KB
0	noref.io Failed noref.io Failed
12	3

	Domain	Requested by
9	kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de	kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
2	newshell.perpussdrahmat.my.id	newshell.perpussdrahmat.my.id
0	noref.io Failed	kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
12	3

This site contains no links.

Subject Issuer	Validity	Valid
de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de R3	`2023-07-25` - `2023-10-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
Frame ID: 1E07AB88F6609DDFA996B7FE1F69669A
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

comdirect Login - Ihr Online Banking & Brokerage | comdirect.de

Page URL History Show full URLs

http://newshell.perpussdrahmat.my.id/com/feasibility/ Page URL
http://newshell.perpussdrahmat.my.id/com/feasibility/ Page URL
https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

463 kB
Transfer

1560 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://newshell.perpussdrahmat.my.id/com/feasibility/ Page URL
http://newshell.perpussdrahmat.my.id/com/feasibility/ Page URL
https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/antibot8/8.php HTTP 302
https://noref.io/

12 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
newshell.perpussdrahmat.my.id/com/feasibility/ 4 KB
2 KB 186ms
91ms Document
text/html 91.215.85.228
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://newshell.perpussdrahmat.my.id/com/feasibility/
Protocol: HTTP/1.1
Server: 91.215.85.228 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: Apache/2.4.56 (Debian) /
Resource Hash: d82828258a532ce7275e076cdd7130dcae0b98bf5f856dcede7f5c350d2c03b8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1657
Content-Type: text/html; charset=UTF-8
Date: Tue, 25 Jul 2023 08:41:28 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.56 (Debian)
Vary: Accept-Encoding

GET
H/1.1 200
OK /
newshell.perpussdrahmat.my.id/com/feasibility/ 121 B
549 B 231ms
230ms Document
text/html 91.215.85.228
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://newshell.perpussdrahmat.my.id/com/feasibility/
Requested by: Host: newshell.perpussdrahmat.my.id
URL: http://newshell.perpussdrahmat.my.id/com/feasibility/
Protocol: HTTP/1.1
Server: 91.215.85.228 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: Apache/2.4.56 (Debian) /
Resource Hash

Request headers

Referer: http://newshell.perpussdrahmat.my.id/com/feasibility/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 125
Content-Type: text/html; charset=UTF-8
Date: Tue, 25 Jul 2023 08:41:29 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.56 (Debian)
Vary: Accept-Encoding

GET
H/1.1 200
OK Primary Request / Show response
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/ 89 KB
18 KB 649ms
468ms Document
text/html 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

b2d089ee251d150d36495fd02e865613e30907215948f52b6854eaabe72465e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://newshell.perpussdrahmat.my.id/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17383
Content-Type: text/html; charset=UTF-8
Date: Tue, 25 Jul 2023 08:41:29 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK MarkWeb-latin-regular.woff2
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/ 15 KB
15 KB 261ms
261ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/MarkWeb-latin-regular.woff2

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
Origin: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:44:38 GMT
Server: nginx/1.14.2
ETag: "3b64-5f81af0e60d80"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15204

GET
H/1.1 200
OK MarkWeb-latin-medium.woff2
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/ 15 KB
15 KB 474ms
328ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/MarkWeb-latin-medium.woff2

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
Origin: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:44:42 GMT
Server: nginx/1.14.2
ETag: "3a60-5f81af1231680"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14944

GET
H/1.1 200
OK MarkWeb-latin-bold.woff2
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/ 15 KB
15 KB 491ms
337ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/MarkWeb-latin-bold.woff2

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

88f151f26d7582598781390eed26f60abfb543395da97d88c168e1f73a23b2f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
Origin: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:44:42 GMT
Server: nginx/1.14.2
ETag: "3c5c-5f81af1231680"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15452

GET
H/1.1 200
OK styleguide-comdirect.css
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/style/ 1 MB
116 KB 547ms
405ms Stylesheet
text/css 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/style/styleguide-comdirect.css

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

441c9d9a45a0b0f65b4a4c11859e72414b4441bf03d7e03e42690b315effd3ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Thu, 30 Mar 2023 10:58:50 GMT
Server: nginx/1.14.2
ETag: "108d76-5f81bfa422e80-gzip"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes

GET
H/1.1 200
OK jquery-3.6.1.min.js Show response
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/js/ 114 KB
34 KB 566ms
408ms Script
application/javascript 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/js/jquery-3.6.1.min.js

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Tue, 14 Feb 2023 19:25:18 GMT
Server: nginx/1.14.2
ETag: "1c995-5f4adec81c380-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34232

GET
H/1.1 200
OK main.js Show response
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/js/ 1 KB
803 B 430ms
267ms Script
application/javascript 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/js/main.js

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

94bc68d20ce20d3053a3cd9a689f42c3c3b08ec927f462e907cdee096542c7a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Thu, 11 May 2023 08:57:24 GMT
Server: nginx/1.14.2
ETag: "4c8-5fb672d506500-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 431

GET

/
noref.io/
Redirect Chain

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/antibot8/8.php
https://noref.io/

0
0

GET
H/1.1 200
OK svg-symbol.svg
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/ 220 KB
220 KB 319ms
319ms Other
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/fonts/svg-symbol.svg

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

92678f37c302748b47f4b34dfb341d184f21f5c74a0db3b19d072151325baf27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 05:40:34 GMT
Server: nginx/1.14.2
ETag: "37064-5f817880c5880"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 225380

GET
DATA 200
OK truncated
/ 797 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5405b0009161e617ee06548d437c8e9fa3a8ce3dafaca161024458ba907c1fc7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 235 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H/1.1 200
OK Newsletter_512x560-1x.jpg
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/images/ 26 KB
26 KB 398ms
398ms Image
image/jpeg 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/images/Newsletter_512x560-1x.jpg

Requested by

Host: kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

e294648a46772c4ff71c3a2f5ecf0ac264389eb1195d7bf75acacc9a4e456d00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Tue, 25 Jul 2023 08:41:30 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 30 Mar 2023 09:50:04 GMT
Server: nginx/1.14.2
ETag: "6721-5f81b04546b00"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26401

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: noref.io
URL: https://noref.io/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
newshell.perpussdrahmat.my.id/	1970-01-20 22:16:50	Name: HFUwLs Value: jnzvqFBoKlbGcTrasDhxIktOedNCfE
newshell.perpussdrahmat.my.id/	1970-01-20 13:31:14	Name: d Value: 0
newshell.perpussdrahmat.my.id/	1970-01-20 13:31:14	Name: n Value: Etc/Unknown
newshell.perpussdrahmat.my.id/	1970-01-20 13:31:14	Name: sp Value: Win32
newshell.perpussdrahmat.my.id/	1970-01-20 13:31:14	Name: su Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/115.0.5790.102%20Safari/537.36
newshell.perpussdrahmat.my.id/	1970-01-20 13:31:14	Name: iu Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/115.0.5790.102%20Safari/537.36
newshell.perpussdrahmat.my.id/	1970-01-20 13:31:14	Name: wd Value: false
newshell.perpussdrahmat.my.id/	1970-01-20 13:45:38	Name: antibot_jnzvqFBoKlbGcTrasDhxIktOedNCfE Value: 830718b13cb4caab04cc846a3bd9afcf-1690274489
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/	1970-01-20 22:16:50	Name: gYEkyM Value: piGTdIKSenXRzqvOulkPyQJFgMtBCm
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/	1970-01-20 13:45:38	Name: antibot_piGTdIKSenXRzqvOulkPyQJFgMtBCm Value: 4a51cbba5c51814ed3076d3e4b57d01d-1690274489
kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: bbsbkvsnot562b8fcshhqng7ls

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/ Message: Access to XMLHttpRequest at 'https://noref.io/#https://www.bp.com/' (redirected from 'https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de/antibot8/8.php') from origin 'https://kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://noref.io/#https://www.bp.com/ Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de
newshell.perpussdrahmat.my.id
noref.io
noref.io
91.215.85.228
91.215.85.230
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970
441c9d9a45a0b0f65b4a4c11859e72414b4441bf03d7e03e42690b315effd3ef
5405b0009161e617ee06548d437c8e9fa3a8ce3dafaca161024458ba907c1fc7
88f151f26d7582598781390eed26f60abfb543395da97d88c168e1f73a23b2f3
92678f37c302748b47f4b34dfb341d184f21f5c74a0db3b19d072151325baf27
94bc68d20ce20d3053a3cd9a689f42c3c3b08ec927f462e907cdee096542c7a8
a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4
b2d089ee251d150d36495fd02e865613e30907215948f52b6854eaabe72465e2
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
d82828258a532ce7275e076cdd7130dcae0b98bf5f856dcede7f5c350d2c03b8
e294648a46772c4ff71c3a2f5ecf0ac264389eb1195d7bf75acacc9a4e456d00

kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de Open in urlscan Pro 91.215.85.230 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

75 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

463 kBTransfer

1560 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

11 Cookies

2 Console Messages

Indicators

kunde-comdirect.de-id91huab12iurg8a90h1rbiua9ohg19rhnb19ah281.com.de Open in urlscan Pro
91.215.85.230 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

463 kB
Transfer

1560 kB
Size

11
Cookies

12 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!