Submitted URL: https://cometabooks.com/google.php
Effective URL: https://strala-gmbh.de/a/e/clients/blz.php?verification
Submission Tags: falconsandbox
Submission: On May 06 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 5.161.107.22, located in United States and belongs to HETZNER-CLOUD2-AS, DE. The main domain is strala-gmbh.de.
TLS certificate: Issued by R3 on May 3rd 2024. Valid for: 3 months.
This is the only time strala-gmbh.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
2 81.93.64.41 25144 (TELEKOM-S...)
1 7 5.161.107.22 213230 (HETZNER-C...)
8 3
Apex Domain
Subdomains
Transfer
7 strala-gmbh.de
strala-gmbh.de
902 KB
2 cometabooks.com
cometabooks.com
683 B
8 2
Domain Requested by
7 strala-gmbh.de 1 redirects strala-gmbh.de
2 cometabooks.com
8 2

This site contains links to these domains. Also see Links.

Domain
www.berliner-sparkasse.de
Subject Issuer Validity Valid
cometabooks.com
R3
2024-03-11 -
2024-06-09
3 months crt.sh
strala-gmbh.de
R3
2024-05-03 -
2024-08-01
3 months crt.sh

This page contains 1 frames:

Primary Page: https://strala-gmbh.de/a/e/clients/blz.php?verification
Frame ID: 4FD7F9096EE2DAA99F6E850391E54A26
Requests: 22 HTTP requests in this frame

Screenshot

Page Title

Login Online-Banking

Page URL History Show full URLs

  1. https://cometabooks.com/google.php Page URL
  2. https://strala-gmbh.de/a/ Page URL
  3. https://strala-gmbh.de/a/e/index.php?pwd=M29juchv7 HTTP 302
    https://strala-gmbh.de/a/e/clients/blz.php?verification Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1231 kB
Transfer

4140 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cometabooks.com/google.php Page URL
  2. https://strala-gmbh.de/a/ Page URL
  3. https://strala-gmbh.de/a/e/index.php?pwd=M29juchv7 HTTP 302
    https://strala-gmbh.de/a/e/clients/blz.php?verification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
google.php
cometabooks.com/
69 B
182 B
Document
General
Full URL
https://cometabooks.com/google.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
81.93.64.41 Banja Luka, Bosnia & Herzegovina, ASN25144 (TELEKOM-SRPSKE-AS Vuka Karadzica 2, BA),
Reverse DNS
cplin41.teol.net
Software
nginx / PHP/8.3.6 PleskLin
Resource Hash
363ca6e854695021811428cce3a305694ec55ef4124133d189bf6ae852b24132

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 06 May 2024 06:18:38 GMT
server
nginx
x-powered-by
PHP/8.3.6 PleskLin
/
strala-gmbh.de/a/
69 B
355 B
Document
General
Full URL
https://strala-gmbh.de/a/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.107.22 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
static.22.107.161.5.clients.your-server.de
Software
nginx / PHP/7.4.33 PleskLin
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://cometabooks.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
83
content-type
text/html; charset=UTF-8
date
Mon, 06 May 2024 06:18:39 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/7.4.33 PleskLin
favicon.ico
cometabooks.com/
808 B
501 B
Other
General
Full URL
https://cometabooks.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
81.93.64.41 Banja Luka, Bosnia & Herzegovina, ASN25144 (TELEKOM-SRPSKE-AS Vuka Karadzica 2, BA),
Reverse DNS
cplin41.teol.net
Software
nginx /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://cometabooks.com/google.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 06 May 2024 06:18:38 GMT
content-encoding
br
last-modified
Thu, 07 Mar 2024 11:35:58 GMT
server
nginx
etag
W/"328-613107aa4f94d"
content-type
text/html
Primary Request blz.php
strala-gmbh.de/a/e/clients/
Redirect Chain
  • https://strala-gmbh.de/a/e/index.php?pwd=M29juchv7
  • https://strala-gmbh.de/a/e/clients/blz.php?verification
3 MB
901 KB
Document
General
Full URL
https://strala-gmbh.de/a/e/clients/blz.php?verification
Requested by
Host: strala-gmbh.de
URL: https://strala-gmbh.de/a/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.107.22 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
static.22.107.161.5.clients.your-server.de
Software
nginx / PHP/7.4.33 PleskLin
Resource Hash
7ef07c01275127f35ad5161aa7ab7a915cb4fe1337667dfecf81b4e8a9a3e74f

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://strala-gmbh.de/a/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 06 May 2024 06:18:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/7.4.33 PleskLin

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 06 May 2024 06:18:39 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
clients/blz.php?verification#_
pragma
no-cache
server
nginx
x-powered-by
PHP/7.4.33 PleskLin
truncated
/
82 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
98bf41236892c0559550c8ca87c4c25687f4457f7bb09aa0a4d41685b5ea5375

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92a47005456ffc3265cfb02b76cfb77edf109347cd59ef3c755aec4ffd4e8e85

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3edc58dd505c594baa6bd39f1641072b5a072f16410c6d0c4bf65df2cdb1d356

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
976 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f4e07d2fb57dd99f228e0d5b6e4e7a8d051ae49bb9643d850ac10369a6158e35

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
24 KB
24 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
43a2c75ca73d8c1101ff7ae617e6dbc6934e8aa1cd72d64ce50908ac297156cb

Request headers

Referer
Origin
https://strala-gmbh.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
205 KB
205 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b8c33d420736e01e78f10be083cb31134439ea40fb1b89b95576518a85627db5

Request headers

Referer
Origin
https://strala-gmbh.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
25 KB
25 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b2888ded6c1e95affe8813aaba8fbcd060d774451c10afa71227616e9af159f

Request headers

Referer
Origin
https://strala-gmbh.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
25 KB
25 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
addffd48c2bb1fe1e4409899c79d5b2beca7d72c4d80575401091f09ab0eae52

Request headers

Referer
Origin
https://strala-gmbh.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
24 KB
24 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0d764d392e1685a777c2740c836285ddf29fc29f29b63c19546baf104c2de3d5

Request headers

Referer
Origin
https://strala-gmbh.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
25 KB
25 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9ae3f33664fc3b273913900b81d8812d5a6a3c098b86d93d1f0ec54259d9441d

Request headers

Referer
Origin
https://strala-gmbh.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
164 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25f042d00f4ce4bcff027d7b7e5c3874e48de1393b3c6172f4775b4ced48c3bc

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
39 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2383da7a90fb1dbc4bf4b2149a8aba7f31cbbfce942f739de2dd4a7771671d22

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
83 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d86fa09a2f9764c54486f84bb248963c9f074897cc923b794dbad6c661ddff10

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
45 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
update_status.php
strala-gmbh.de/a/e/
0
182 B
XHR
General
Full URL
https://strala-gmbh.de/a/e/update_status.php?ip=217.114.218.21
Requested by
Host: strala-gmbh.de
URL: https://strala-gmbh.de/a/e/clients/blz.php?verification
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.107.22 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
static.22.107.161.5.clients.your-server.de
Software
nginx / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://strala-gmbh.de/a/e/clients/blz.php?verification
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 06 May 2024 06:18:42 GMT
server
nginx
x-powered-by
PHP/7.4.33, PleskLin
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
update_status.php
strala-gmbh.de/a/e/
0
182 B
XHR
General
Full URL
https://strala-gmbh.de/a/e/update_status.php?ip=217.114.218.21
Requested by
Host: strala-gmbh.de
URL: https://strala-gmbh.de/a/e/clients/blz.php?verification
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.107.22 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
static.22.107.161.5.clients.your-server.de
Software
nginx / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://strala-gmbh.de/a/e/clients/blz.php?verification
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 06 May 2024 06:18:43 GMT
server
nginx
x-powered-by
PHP/7.4.33, PleskLin
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
update_status.php
strala-gmbh.de/a/e/
0
182 B
XHR
General
Full URL
https://strala-gmbh.de/a/e/update_status.php?ip=217.114.218.21
Requested by
Host: strala-gmbh.de
URL: https://strala-gmbh.de/a/e/clients/blz.php?verification
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.107.22 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
static.22.107.161.5.clients.your-server.de
Software
nginx / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://strala-gmbh.de/a/e/clients/blz.php?verification
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 06 May 2024 06:18:44 GMT
server
nginx
x-powered-by
PHP/7.4.33, PleskLin
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
update_status.php
strala-gmbh.de/a/e/
0
182 B
XHR
General
Full URL
https://strala-gmbh.de/a/e/update_status.php?ip=217.114.218.21
Requested by
Host: strala-gmbh.de
URL: https://strala-gmbh.de/a/e/clients/blz.php?verification
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.161.107.22 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS
static.22.107.161.5.clients.your-server.de
Software
nginx / PHP/7.4.33, PleskLin
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://strala-gmbh.de/a/e/clients/blz.php?verification
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 06 May 2024 06:18:45 GMT
server
nginx
x-powered-by
PHP/7.4.33, PleskLin
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

1 Cookies

Domain/Path Name / Value
strala-gmbh.de/ Name: PHPSESSID
Value: pe3sbktsa4l0j60ior7dqkiosd

1 Console Messages

Source Level URL
Text
network error URL: https://cometabooks.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()