kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de Open in urlscan Pro
91.215.85.230 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/25ye3obg
Effective URL:
https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
Submission: On August 11 via manual (August 11th 2023, 11:39:34 am UTC) from DE — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 12 HTTP transactions. The main IP is 91.215.85.230, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de.
TLS certificate: Issued by R3 on August 8th 2023. Valid for: 3 months.

This is the only time kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commerzbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::ac43:1e1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1 3	91.215.85.228 91.215.85.228	200593 (PROSPERO-AS) (PROSPERO-AS)
9	91.215.85.230 91.215.85.230	200593 (PROSPERO-AS) (PROSPERO-AS)
12	3

1 2606:4700:10::ac43:1e1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.bt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.215.85.228 (Russian Federation) 1 redirects

ASN200593 (PROSPERO-AS, RU)

newshell.hamyasdeco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 91.215.85.230 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)

kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	com.de kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de	330 KB
3	hamyasdeco.com 1 redirects newshell.hamyasdeco.com	3 KB
1	google.bt www.google.bt — Cisco Umbrella Rank: 35822	1 KB
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 16708	596 B
12	4

	Domain	Requested by
9	kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de	kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
3	newshell.hamyasdeco.com	1 redirects www.google.bt newshell.hamyasdeco.com
1	www.google.bt
1	tinyurl.com	1 redirects
12	4

This site contains no links.

Subject Issuer	Validity	Valid
*.google.bt GTS CA 1C3	`2023-07-17` - `2023-10-09`	3 months	crt.sh
at-id189bnfi21ubafb1u9oafb1huahbn1oiah1i.com.de R3	`2023-08-08` - `2023-11-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
Frame ID: 0ACFC24B07C7CA2368B9172E7DB05095
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

comdirect Login - Ihr Online Banking & Brokerage

Page URL History Show full URLs

https://tinyurl.com/25ye3obg HTTP 301
https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d... Page URL
http://newshell.hamyasdeco.com/com/shareable HTTP 301
http://newshell.hamyasdeco.com/com/shareable/ Page URL
http://newshell.hamyasdeco.com/com/shareable/ Page URL
https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

83 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

334 kB
Transfer

440 kB
Size

13
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/25ye3obg HTTP 301
https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5 Page URL
http://newshell.hamyasdeco.com/com/shareable HTTP 301
http://newshell.hamyasdeco.com/com/shareable/ Page URL
http://newshell.hamyasdeco.com/com/shareable/ Page URL
https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/25ye3obg HTTP 301
https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5

Request Chain 1

http://newshell.hamyasdeco.com/com/shareable HTTP 301
http://newshell.hamyasdeco.com/com/shareable/

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

url Show response
www.google.bt/
Redirect Chain

https://tinyurl.com/25ye3obg
https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5

388 B
1 KB

168ms
67ms

Document
text/html

2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

8b6fed4cb86520c53d6770f53208d2d6de416b6117c8b9ae84bab4e878eeaccb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 388
content-type: text/html; charset=UTF-8
date: Fri, 11 Aug 2023 11:39:28 GMT
expires: Fri, 11 Aug 2023 11:39:28 GMT
location: http://newshell.hamyasdeco.com/com/shareable
origin-trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy: unload=()
server: gws
strict-transport-security: max-age=31536000
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0, public, s-max-age=900, stale-if-error: 86400
cf-cache-status: DYNAMIC
cf-ray: 7f5032b8df464dc1-FRA
content-type: text/html; charset=UTF-8
date: Fri, 11 Aug 2023 11:39:27 GMT
location: https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5
referrer-policy: unsafe-url
server: cloudflare
x-content-type-options: nosniff
x-tinyurl-redirect: eyJpdiI6IlpHQWU2dHBta3FXZWtZc2hkbUpmYWc9PSIsInZhbHVlIjoiN1pabFFNd3NnNnNNM2wydS81NkUxaEl1bFJJTytpMlE0dFp1N2Y4K1o1VlM4em5sMTFKQllHZ1creldsNFg1ayIsIm1hYyI6ImZiMzM1YWVjNGZiMzhkNjhiZTc1MTczOTk2MjExODgzZjZlZWYxYzVkYzhiZGE5ZmEwYzYzODc1ZTUyZTc4ODIiLCJ0YWciOiIifQ==
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

/ Show response
newshell.hamyasdeco.com/com/shareable/
Redirect Chain

http://newshell.hamyasdeco.com/com/shareable
http://newshell.hamyasdeco.com/com/shareable/

4 KB
2 KB

88ms
88ms

Document
text/html

91.215.85.228
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://newshell.hamyasdeco.com/com/shareable/
Requested by: Host: www.google.bt
URL: https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5
Protocol: HTTP/1.1
Server: 91.215.85.228 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: Apache/2.4.56 (Debian) /
Resource Hash: 9d251ac32e4f14cfd6f9178117139e66d3b73fb1bc304e46d61ff980cc7fd682

Request headers

Referer: https://www.google.bt/url?q=ht%74%70%3A%2F%2F%6eew%73%68%65%6cl%2ehamya%73%64%65c%6f.com%2Fc%6f%6d%2F%73h%61%72eabl%65&sa=D&sntz=1&usg=AOvVaw2Tk7B48qCAE91OTE30nmV5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1572
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Aug 2023 11:39:28 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.56 (Debian)
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 342
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 11 Aug 2023 11:39:28 GMT
Keep-Alive: timeout=5, max=100
Location: http://newshell.hamyasdeco.com/com/shareable/
Server: Apache/2.4.56 (Debian)

GET
H/1.1 200
OK / Show response
newshell.hamyasdeco.com/com/shareable/ 128 B
553 B 224ms
224ms Document
text/html 91.215.85.228
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://newshell.hamyasdeco.com/com/shareable/
Requested by: Host: newshell.hamyasdeco.com
URL: http://newshell.hamyasdeco.com/com/shareable/
Protocol: HTTP/1.1
Server: 91.215.85.228 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: Apache/2.4.56 (Debian) /
Resource Hash: 465e25029666df48374e0e4031254ff7d536c8d172ef9e7027e405f8a9186486

Request headers

Referer: http://newshell.hamyasdeco.com/com/shareable/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 129
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Aug 2023 11:39:28 GMT
Keep-Alive: timeout=5, max=98
Server: Apache/2.4.56 (Debian)
Vary: Accept-Encoding

GET
H/1.1 200
OK Primary Request / Show response
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/ 22 KB
7 KB 417ms
256ms Document
text/html 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

6a3c975e1f0d3bf0516bdcb073a66febf23c0cad2ce954fee51149e5c6c4affa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://newshell.hamyasdeco.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 6553
Content-Type: text/html; charset=UTF-8
Date: Fri, 11 Aug 2023 11:39:29 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx/1.14.2
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK style.css
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/ 15 KB
3 KB 247ms
246ms Stylesheet
text/css 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

4528130ea852bf2097a75ef6f93136a5a2434f51d7e5e1a5049cc2c9aeea97ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 28 Jul 2023 20:03:52 GMT
Server: nginx/1.14.2
ETag: "3dce-6019194681a00-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2725

GET
H/1.1 200
OK row.svg
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/ 235 B
545 B 383ms
241ms Image
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/row.svg

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:46:58 GMT
Server: nginx/1.14.2
ETag: "eb-60179dfd1c080"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 235

GET
H/1.1 200
OK mainimg.jpg
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/ 18 KB
18 KB 542ms
384ms Image
image/jpeg 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/mainimg.jpg

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

780c3db072081058eef9a112d20686bf1a1d322106432fed1a1f6d8daa600ea5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 28 Jul 2023 16:44:24 GMT
Server: nginx/1.14.2
ETag: "4735-6018ecb0eea00"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18229

GET
H/1.1 200
OK jquery-3.6.1.min.js Show response
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/js/ 114 KB
34 KB 522ms
380ms Script
application/javascript 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/js/jquery-3.6.1.min.js

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Wed, 15 Feb 2023 00:25:18 GMT
Server: nginx/1.14.2
ETag: "1c995-5f4b21d63f780-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34232

GET
H/1.1 200
OK svg-symbol.svg
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/ 236 KB
237 KB 542ms
384ms Other
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/svg-symbol.svg

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

f3b4f40ab4ae39f66dc00f49c75cf1d317b385b2bb29d8a008c57402f1be56bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:03:30 GMT
Server: nginx/1.14.2
ETag: "3b125-60179445ed480"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 241957

GET
H/1.1 200
OK logo.svg
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/ 486 B
797 B 246ms
246ms Image
image/svg+xml 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/img/logo.svg

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

5f97323fcf36ab737a689fba9406d05a0fcc6cc17a232b9077176e2f3951f414

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Mon, 31 Jul 2023 12:03:42 GMT
Server: nginx/1.14.2
ETag: "1e6-601c738b88380"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 486

GET
H/1.1 200
OK MarkWeb-latin-regular.woff2
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/fonts/ 15 KB
15 KB 446ms
315ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/fonts/MarkWeb-latin-regular.woff2?v=1688713441619

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css
Origin: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:09:00 GMT
Server: nginx/1.14.2
ETag: "3b64-60179580a3b00"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15204

GET
H/1.1 200
OK MarkWeb-latin-medium.woff2
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/fonts/ 15 KB
15 KB 451ms
316ms Font
application/octet-stream 91.215.85.230
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/fonts/MarkWeb-latin-medium.woff2?v=1688713441619

Requested by

Host: kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
URL: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.215.85.230 , Russian Federation, ASN200593 (PROSPERO-AS, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/start/css/style.css
Origin: https://kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 11 Aug 2023 11:39:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 27 Jul 2023 15:09:00 GMT
Server: nginx/1.14.2
ETag: "3a60-60179580a3b00"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14944

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commerzbank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.bt/	1970-01-20 23:25:40	Name: __Secure-ENID Value: 14.SE=T-AWIBvy0zdlX_vOC1thkEQbUeVuDpbAZmuBLwdQdaJQefca_nXsvf3E7CmM4Feb6R2aQT74GYxxnnh3tXEIzpCuKkwC0MR2Sl4fKxMLk_ouLes_x8CZRwgY1YCuP26DQlDhNqdzsUFI3ipfCNM-X0yj5ESU-xc-9q5mNkA54r0
.google.bt/	1970-01-20 23:31:53	Name: CONSENT Value: PENDING+373
newshell.hamyasdeco.com/	1970-01-20 22:41:29	Name: HFUwLs Value: fXdAkvQMgEWnlpKmBPTGzYLsHRVoUy
newshell.hamyasdeco.com/	1970-01-20 14:10:17	Name: antibot_fXdAkvQMgEWnlpKmBPTGzYLsHRVoUy Value: 2be290078b901dd62ff687c16f6cbda7-1691753968
newshell.hamyasdeco.com/	1970-01-20 13:55:54	Name: d Value: 120
newshell.hamyasdeco.com/	1970-01-20 13:55:54	Name: n Value: Europe/Berlin
newshell.hamyasdeco.com/	1970-01-20 13:55:54	Name: sp Value: Win32
newshell.hamyasdeco.com/	1970-01-20 13:55:54	Name: su Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/115.0.5790.170%20Safari/537.36
newshell.hamyasdeco.com/	1970-01-20 13:55:54	Name: iu Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/115.0.5790.170%20Safari/537.36
newshell.hamyasdeco.com/	1970-01-20 13:55:54	Name: wd Value: false
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/	1970-01-20 22:41:29	Name: gYEkyM Value: oYfZSQClTtxaBibMcAKhyRJGHVkdPw
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/	1970-01-20 14:10:17	Name: antibot_oYfZSQClTtxaBibMcAKhyRJGHVkdPw Value: 9f8f1e25bcd936d066fe117d0554042a-1691753969
kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: i0p9361s6e8nqb4pa5lmcbft83

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'unload'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de
newshell.hamyasdeco.com
tinyurl.com
www.google.bt
2606:4700:10::ac43:1e1
2a00:1450:4001:827::2003
91.215.85.228
91.215.85.230
21434445c408f9854cbec5c56ba5badf907aa3b6ccac4fca736b1322b8f4b347
388e491e4fcbdfefb0c437cf0d0f42f506ed878c8564e6b1817368fc6e49e970
4528130ea852bf2097a75ef6f93136a5a2434f51d7e5e1a5049cc2c9aeea97ed
465e25029666df48374e0e4031254ff7d536c8d172ef9e7027e405f8a9186486
5f97323fcf36ab737a689fba9406d05a0fcc6cc17a232b9077176e2f3951f414
6a3c975e1f0d3bf0516bdcb073a66febf23c0cad2ce954fee51149e5c6c4affa
780c3db072081058eef9a112d20686bf1a1d322106432fed1a1f6d8daa600ea5
8b6fed4cb86520c53d6770f53208d2d6de416b6117c8b9ae84bab4e878eeaccb
9d251ac32e4f14cfd6f9178117139e66d3b73fb1bc304e46d61ff980cc7fd682
a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4
cd1af2ed494662d6ac322cf1048707eac9fc53561d1c9b5e0e7074599eb65773
f3b4f40ab4ae39f66dc00f49c75cf1d317b385b2bb29d8a008c57402f1be56bc

kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de Open in urlscan Pro 91.215.85.230 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

83 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

334 kBTransfer

440 kBSize

13 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

13 Cookies

1 Console Messages

Security Headers

Indicators

kunde-comdirect.de-id91bnh2fauib12qrbkab18ihafbn1juiahf91hn1i.com.de Open in urlscan Pro
91.215.85.230 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

83 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

334 kB
Transfer

440 kB
Size

13
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!