kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de Open in urlscan Pro
91.215.85.230 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/293g9l5b
Effective URL:
https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
Submission: On August 18 via manual (August 18th 2023, 6:02:44 am UTC) from DE — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 91.215.85.230, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de.
TLS certificate: Issued by R3 on August 14th 2023. Valid for: 3 months.

This is the only time kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::ac43:1e1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	91.215.85.228 91.215.85.228	200593 (PROSPERO-AS) (PROSPERO-AS)
9	91.215.85.230 91.215.85.230	200593 (PROSPERO-AS) (PROSPERO-AS)
11	2

1 2606:4700:10::ac43:1e1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.215.85.228 (Russian Federation) 1 redirects

ASN200593 (PROSPERO-AS, RU)

shell.mirfidecilik.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 91.215.85.230 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)

kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	com.de kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de	330 KB
3	mirfidecilik.com 1 redirects shell.mirfidecilik.com	3 KB
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 18012	510 B
11	3

	Domain	Requested by
9	kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de	kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
3	shell.mirfidecilik.com	1 redirects shell.mirfidecilik.com
1	tinyurl.com	1 redirects
11	3

This site contains no links.

Subject Issuer	Validity	Valid
de-id81baib1r9ghakjf12891hkabnf181amjd.com.de R3	`2023-08-14` - `2023-11-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
Frame ID: 3BD00D9A1CB492FA9F2BBC3E3994B846
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

comdirect Login - Ihr Online Banking & Brokerage

Page URL History Show full URLs

https://tinyurl.com/293g9l5b HTTP 301
http://shell.mirfidecilik.com/comdirect/circle HTTP 301
http://shell.mirfidecilik.com/comdirect/circle/ Page URL
http://shell.mirfidecilik.com/comdirect/circle/ Page URL
https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

82 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

333 kB
Transfer

439 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/293g9l5b HTTP 301
http://shell.mirfidecilik.com/comdirect/circle HTTP 301
http://shell.mirfidecilik.com/comdirect/circle/ Page URL
http://shell.mirfidecilik.com/comdirect/circle/ Page URL
https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/293g9l5b HTTP 301
http://shell.mirfidecilik.com/comdirect/circle HTTP 301
http://shell.mirfidecilik.com/comdirect/circle/

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/
shell.mirfidecilik.com/comdirect/circle/
Redirect Chain

https://tinyurl.com/293g9l5b
http://shell.mirfidecilik.com/comdirect/circle
http://shell.mirfidecilik.com/comdirect/circle/

4 KB
2 KB

91ms
90ms

Document
text/html

91.215.85.228
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://shell.mirfidecilik.com/comdirect/circle/
Protocol: HTTP/1.1
Server: 91.215.85.228 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: Apache/2.4.56 (Debian) /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1602
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Aug 2023 06:02:37 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.56 (Debian)
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 343
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 18 Aug 2023 06:02:37 GMT
Keep-Alive: timeout=5, max=100
Location: http://shell.mirfidecilik.com/comdirect/circle/
Server: Apache/2.4.56 (Debian)

GET
H/1.1 200
OK /
shell.mirfidecilik.com/comdirect/circle/ 121 B
549 B 321ms
321ms Document
text/html 91.215.85.228
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://shell.mirfidecilik.com/comdirect/circle/
Requested by: Host: shell.mirfidecilik.com
URL: http://shell.mirfidecilik.com/comdirect/circle/
Protocol: HTTP/1.1
Server: 91.215.85.228 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: Apache/2.4.56 (Debian) /
Resource Hash

Request headers

Referer: http://shell.mirfidecilik.com/comdirect/circle/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 125
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Aug 2023 06:02:38 GMT
Keep-Alive: timeout=5, max=98
Server: Apache/2.4.56 (Debian)
Vary: Accept-Encoding

GET
H/1.1 200
OK Primary Request / Show response
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/ 22 KB
7 KB 439ms
256ms Document
text/html 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

6a3c975e1f0d3bf0516bdcb073a66febf23c0cad2ce954fee51149e5c6c4affa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://shell.mirfidecilik.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 6553
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Aug 2023 06:02:39 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK style.css
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/ 15 KB
3 KB 244ms
243ms Stylesheet
text/css 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

4528130ea852bf2097a75ef6f93136a5a2434f51d7e5e1a5049cc2c9aeea97ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 28 Jul 2023 20:03:52 GMT
Server: nginx/1.14.2
ETag: "3dce-6019194681a00-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2725

GET
H/1.1 200
OK row.svg
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/ 235 B
545 B 400ms
244ms Image
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/row.svg

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:46:58 GMT
Server: nginx/1.14.2
ETag: "eb-60179dfd1c080"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 235

GET
H/1.1 200
OK mainimg.jpg
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/ 18 KB
18 KB 559ms
405ms Image
image/jpeg 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/mainimg.jpg

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

780c3db072081058eef9a112d20686bf1a1d322106432fed1a1f6d8daa600ea5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 28 Jul 2023 16:44:24 GMT
Server: nginx/1.14.2
ETag: "4735-6018ecb0eea00"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18229

GET
H/1.1 200
OK jquery-3.6.1.min.js Show response
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/js/ 114 KB
34 KB 532ms
384ms Script
application/javascript 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/js/jquery-3.6.1.min.js

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Wed, 15 Feb 2023 00:25:18 GMT
Server: nginx/1.14.2
ETag: "1c995-5f4b21d63f780-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34232

GET
H/1.1 200
OK svg-symbol.svg
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/ 236 KB
237 KB 551ms
397ms Other
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/svg-symbol.svg

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

f3b4f40ab4ae39f66dc00f49c75cf1d317b385b2bb29d8a008c57402f1be56bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:03:30 GMT
Server: nginx/1.14.2
ETag: "3b125-60179445ed480"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 241957

GET
H/1.1 200
OK logo.svg
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/ 486 B
797 B 248ms
242ms Image
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/img/logo.svg

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

5f97323fcf36ab737a689fba9406d05a0fcc6cc17a232b9077176e2f3951f414

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Mon, 31 Jul 2023 12:03:42 GMT
Server: nginx/1.14.2
ETag: "1e6-601c738b88380"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 486

GET
H/1.1 200
OK MarkWeb-latin-regular.woff2
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/fonts/ 15 KB
15 KB 470ms
320ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/fonts/MarkWeb-latin-regular.woff2?v=1688713441619

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css
Origin: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:09:00 GMT
Server: nginx/1.14.2
ETag: "3b64-60179580a3b00"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15204

GET
H/1.1 200
OK MarkWeb-latin-medium.woff2
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/fonts/ 15 KB
15 KB 464ms
321ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/fonts/MarkWeb-latin-medium.woff2?v=1688713441619

Requested by

Host: kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
URL: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/start/css/style.css
Origin: https://kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date: Fri, 18 Aug 2023 06:02:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:09:00 GMT
Server: nginx/1.14.2
ETag: "3a60-60179580a3b00"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14944

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
shell.mirfidecilik.com/	1970-01-20 22:51:14	Name: HFUwLs Value: oxOQJMVqDNlpuaAiXPHzYfTSeWrcBd
shell.mirfidecilik.com/	1970-01-20 14:05:38	Name: d Value: 120
shell.mirfidecilik.com/	1970-01-20 14:05:38	Name: n Value: Europe/Berlin
shell.mirfidecilik.com/	1970-01-20 14:05:38	Name: sp Value: Win32
shell.mirfidecilik.com/	1970-01-20 14:05:38	Name: su Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/116.0.5845.96%20Safari/537.36
shell.mirfidecilik.com/	1970-01-20 14:05:38	Name: iu Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/116.0.5845.96%20Safari/537.36
shell.mirfidecilik.com/	1970-01-20 14:05:38	Name: wd Value: false
shell.mirfidecilik.com/	1970-01-20 14:20:02	Name: antibot_oxOQJMVqDNlpuaAiXPHzYfTSeWrcBd Value: b03b2b693430a41c22cf3f27e9722149-1692338558
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/	1970-01-20 22:51:14	Name: gYEkyM Value: atboUjXEzQqmgNZcDIhnfRSldVkYuy
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/	1970-01-20 14:20:02	Name: antibot_atboUjXEzQqmgNZcDIhnfRSldVkYuy Value: 70c28792133207638e6710c8e92139a8-1692338559
kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6m1svqd310esupl04eegsd7bdg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de
shell.mirfidecilik.com
tinyurl.com
2606:4700:10::ac43:1e1
91.215.85.228
91.215.85.230
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970
4528130ea852bf2097a75ef6f93136a5a2434f51d7e5e1a5049cc2c9aeea97ed
5f97323fcf36ab737a689fba9406d05a0fcc6cc17a232b9077176e2f3951f414
6a3c975e1f0d3bf0516bdcb073a66febf23c0cad2ce954fee51149e5c6c4affa
780c3db072081058eef9a112d20686bf1a1d322106432fed1a1f6d8daa600ea5
a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
f3b4f40ab4ae39f66dc00f49c75cf1d317b385b2bb29d8a008c57402f1be56bc

kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de Open in urlscan Pro 91.215.85.230 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

333 kBTransfer

439 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

11 Cookies

Indicators

kunde-comdirect.de-id81baib1r9ghakjf12891hkabnf181amjd.com.de Open in urlscan Pro
91.215.85.230 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

333 kB
Transfer

439 kB
Size

11
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!