s-guerel.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is s-guerel.com.
TLS certificate: Issued by GTS CA 1P5 on August 31st 2023. Valid for: 3 months.

This is the only time s-guerel.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 5	2a06:98c1:312... 2a06:98c1:3121::3		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

5 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

s-guerel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	s-guerel.com 1 redirects s-guerel.com	145 KB
4	1

	Domain	Requested by
5	s-guerel.com	1 redirects s-guerel.com
4	1

This site contains no links.

Subject Issuer	Validity	Valid
s-guerel.com GTS CA 1P5	`2023-08-31` - `2023-11-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX
Frame ID: 9A9430710D683D75CC28158EB407CC91
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anmeldung zum Online Banking - Commerzbank

Page URL History Show full URLs

https://s-guerel.com/ HTTP 302
https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

161 kB
Transfer

493 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s-guerel.com/ HTTP 302
https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.pk.php Show response s-guerel.com/ Redirect Chain https://s-guerel.com/ https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX	8 KB 2 KB	119ms 118ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `49da11aee6a83927982bf6e287d5e90c6571d10e6ccc0a2f5c5baef337c7e9b4` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 80166e21fa061e53-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 04 Sep 2023 13:03:01 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZdbYYulBR9Yk3qAgq9p7VZMynu07euwLPXVqpiZhfJ9znyVm79OLtHNR2S2n%2FknoL7wXpIlbeALL7dcWCnwUp4yLg9XW6vU4u2wQSAZa74YwHiwegWg9M6Z22hQq2CgfLaryjM%2BBOYhna2U%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 80166e200ead1e53-FRA content-type text/html; charset=UTF-8 date Mon, 04 Sep 2023 13:03:01 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2BigcKm7IyiJdtezld%2FMrc9cNqBc99aXsltdjOZDr7MMc6IfEvzrAIu1DPWXaXmFFWCsRtJx4UhhPXruwHhT5D0R77WbATdh4dvUMSfP%2BGZwrReEG3Nqqd%2B74KoSH2r1JnVXgwJHdTMVgwc%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	200	main.php s-guerel.com/dist/sheet/	418 KB 113 KB	161ms 160ms	Stylesheet text/css	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://s-guerel.com/dist/sheet/main.php Requested by Host: s-guerel.com URL: https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `92f2dcf887375884651256828be61426867b20fbde9c0523276b218df8c1000e` Request headers accept-language de-DE,de;q=0.9 Referer https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers pragma no-cache date Mon, 04 Sep 2023 13:03:01 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2FUBwmav%2FBD5ySzd1kShOVEBNNET5CDkv2JNAdk4qykOA5z%2F9YWMu2Zvo%2BUOfZYrxtW1hvhBBc%2FzSjirZYgvcJLTNcKQKwqAGXluR%2B%2BeVwYgY3IMlij%2FnAINYdGhvL2kavdaDy%2F%2FZ5dIu94%3D"}],"group":"cf-nel","max_age":604800} content-type text/css;charset=UTF-8 cache-control no-store, no-cache, must-revalidate cf-ray 80166e22bf8c3735-FRA alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	logo_big_svg.svg s-guerel.com/dist/images/	10 KB 3 KB	220ms 219ms	Image image/svg+xml	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://s-guerel.com/dist/images/logo_big_svg.svg Requested by Host: s-guerel.com URL: https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da` Request headers accept-language de-DE,de;q=0.9 Referer https://s-guerel.com/login.pk.php?lp=iWKUd&pk?=QYnRxPtiueD7bZX User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Mon, 04 Sep 2023 13:03:01 GMT content-encoding br cf-cache-status MISS last-modified Mon, 04 Sep 2023 01:34:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"2658-6047e8453f311" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WtbDtHM3Os1BTOqDSpwdcoZsI%2FTMaRJ5nLOXoeJPv14pWo7UzfBZm7hbqgLznHk63XBVGrfHIKcozEwiiv0Nm%2FFYaqLnpIsr4sDS8Xzy5xJzX6jhc8QIwoSI5IByI4rtu5bEPQ8eAlMPV6Q%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 cf-ray 80166e22cf923735-FRA alt-svc h3=":443"; ma=86400
GET H3	200	icons_woff.woff s-guerel.com/dist/fonts/	40 KB 26 KB	202ms 202ms	Font application/font-woff	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://s-guerel.com/dist/fonts/icons_woff.woff Requested by Host: s-guerel.com URL: https://s-guerel.com/dist/sheet/main.php Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b52db98725cfebc3ea28099617bd8ec31fe8fb5cf63d8d30d1c375fd64c19876` Request headers Referer https://s-guerel.com/dist/sheet/main.php Origin https://s-guerel.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Mon, 04 Sep 2023 13:03:02 GMT content-encoding br cf-cache-status MISS last-modified Mon, 04 Sep 2023 01:34:48 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"9e84-6047e840e8d59" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7IR8ZLvHQVSEIOgwrmg8liLAVlc54786VDhUWOADVQmRdtXc1Bs5UoITS1l9TiGNBo2KAecrPvrjldkaYC7%2BcfJ2xl7ukfBHH3f%2BOJAmlDZpPigNJY8WjOTjQlFwFrtimttwHQ1z7HkS2hU%3D"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 80166e251b453735-FRA alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	17 KB 17 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75` Request headers Referer Origin https://s-guerel.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Content-Type application/x-font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			s-guerel.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4l36p2i9caqioh0ml9t7ir7dh7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s-guerel.com
2a06:98c1:3121::3
2a75c64cb8c3aeb7705e8822c14a4ad9da1713c0bd48d0258afd6d38b858b9da
49da11aee6a83927982bf6e287d5e90c6571d10e6ccc0a2f5c5baef337c7e9b4
8e0cac4821c935482392023f91f3c6814b9c2337ec4dabadf995b5fb95f61a75
92f2dcf887375884651256828be61426867b20fbde9c0523276b218df8c1000e
b52db98725cfebc3ea28099617bd8ec31fe8fb5cf63d8d30d1c375fd64c19876

s-guerel.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

161 kBTransfer

493 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

s-guerel.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

161 kB
Transfer

493 kB
Size

1
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!