sparka-kundentermin2022.com Open in urlscan Pro
85.193.88.237 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.google.bf/url?q=https%3A%2F%2Fsparka-kundentermin2022.com%2FTT1EHQYUCS%3F87550957314&sa=D&sntz=1&usg=AOvVa...
Effective URL:
https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Submission: On May 29 via api (May 29th 2022, 9:17:14 am UTC) from BE — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 17 HTTP transactions. The main IP is 85.193.88.237, located in Russian Federation and belongs to TIMEWEB-AS, RU. The main domain is sparka-kundentermin2022.com.
TLS certificate: Issued by R3 on May 25th 2022. Valid for: 3 months.

This is the only time sparka-kundentermin2022.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
14	85.193.88.237 85.193.88.237	9123 (TIMEWEB-AS) (TIMEWEB-AS)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
17	3

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.bf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 85.193.88.237 (Russian Federation)

ASN9123 (TIMEWEB-AS, RU)
PTR: 910845-cj36302.tmweb.ru

sparka-kundentermin2022.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	sparka-kundentermin2022.com sparka-kundentermin2022.com	2 MB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 624	132 KB
1	google.bf www.google.bf — Cisco Umbrella Rank: 36952	1 KB
17	3

	Domain	Requested by
14	sparka-kundentermin2022.com	www.google.bf sparka-kundentermin2022.com
2	code.jquery.com	sparka-kundentermin2022.com
1	www.google.bf
17	3

This site contains no links.

Subject Issuer	Validity	Valid
*.google.bf GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
sparka-kundentermin2022.com R3	`2022-05-25` - `2022-08-23`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Frame ID: DC66899CEEE7D3FC363F9BE2151903FA
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TAN-Verfahren Aktualisierung | Sparkasse

Page URL History Show full URLs

https://www.google.bf/url?q=https%3A%2F%2Fsparka-kundentermin2022.com%2FTT1EHQYUCS%3F87550957314&s... Page URL
https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314 Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*parbase
/etc/clientlibs/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

2649 kB
Transfer

3129 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.google.bf/url?q=https%3A%2F%2Fsparka-kundentermin2022.com%2FTT1EHQYUCS%3F87550957314&sa=D&sntz=1&usg=AOvVaw2V97W6O1ZrNp9VcMmlqqyc Page URL
https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 url Show response
www.google.bf/ 430 B
1 KB 72ms
28ms Document
text/html 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.bf/url?q=https%3A%2F%2Fsparka-kundentermin2022.com%2FTT1EHQYUCS%3F87550957314&sa=D&sntz=1&usg=AOvVaw2V97W6O1ZrNp9VcMmlqqyc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

eb31deaf233ffa53656dde832c5967b51d0ce12ca5d4f5809f4116a02dfabe1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bfcache-opt-in: unload
cache-control: private
content-length: 430
content-type: text/html; charset=UTF-8
date: Sun, 29 May 2022 09:17:09 GMT
expires: Sun, 29 May 2022 09:17:09 GMT
location: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: gws
strict-transport-security: max-age=31536000
x-xss-protection: 0

GET
H/1.1 200
OK Primary Request TT1EHQYUCS Show response
sparka-kundentermin2022.com/ 83 KB
19 KB 730ms
221ms Document
text/html 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Requested by: Host: www.google.bf
URL: https://www.google.bf/url?q=https%3A%2F%2Fsparka-kundentermin2022.com%2FTT1EHQYUCS%3F87550957314&sa=D&sntz=1&usg=AOvVaw2V97W6O1ZrNp9VcMmlqqyc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 5aee45746484b27e97c461327fe8bf4e6ee210ea4071845ec759a86fc2142353

Request headers

Referer: https://www.google.bf/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 29 May 2022 09:17:10 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H2 200 jquery-ui.css
code.jquery.com/ui/1.13.1/themes/base/ 35 KB
8 KB 83ms
27ms Stylesheet
text/css 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.13.1/themes/base/jquery-ui.css
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 58a6f49e92f7d2fd1246d98c568c2ac7d6be832ddfece67ec9f7ef3332766adf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Sun, 29 May 2022 09:17:10 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-8d03"
vary: Accept-Encoding
x-hw: 1653815830.dop130.fr8.t,1653815830.cds203.fr8.hn,1653815830.cds265.fr8.c
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 8356

GET
H/1.1 200
OK internetfiliale.min.css
sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/ 1 MB
1 MB 38ms
38ms Stylesheet
text/css 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: a914f6b586a82a465b80ad4eff1132f00307932841c2e785541c0e5eb5f3a4ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:10 GMT
Last-Modified: Sun, 15 May 2022 17:06:19 GMT
Server: nginx
ETag: "6281330b-17e7ba"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1566650

GET
H/1.1 200
OK internetfiliale.min.js Show response
sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/ 433 KB
434 KB 180ms
81ms Script
application/javascript 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.js
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 9458c9806502a7e9c0e8b5bf28f6b26a07548e36882e75c16d6986e8b164ba80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:10 GMT
Last-Modified: Fri, 13 May 2022 12:40:09 GMT
Server: nginx
ETag: "627e51a9-6c531"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 443697

GET
H/1.1 200
OK logo_ini.svg
sparka-kundentermin2022.com/ 22 KB
22 KB 38ms
38ms Image
image/svg+xml 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/logo_ini.svg
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:10 GMT
Last-Modified: Fri, 13 May 2022 17:02:42 GMT
Server: nginx
ETag: "627e8f32-58be"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22718

GET
H/1.1 200
OK spk-logo-mobile.png
sparka-kundentermin2022.com/content/dam/myif/ssk-dessau/work/bilder/logos/ 3 KB
3 KB 41ms
41ms Image
image/png 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/content/dam/myif/ssk-dessau/work/bilder/logos/spk-logo-mobile.png
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 80aeb0da8af66eee8e280ad954dbeae4acc943c9cbd46f5d7f5d9d86cde702df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:10 GMT
Last-Modified: Thu, 12 May 2022 22:01:44 GMT
Server: nginx
ETag: "627d83c8-d13"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3347

GET
H/1.1 200
OK spk-logo-druck.png
sparka-kundentermin2022.com/content/dam/myif/ssk-dessau/work/bilder/logos/ 10 KB
10 KB 43ms
38ms Image
image/png 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/content/dam/myif/ssk-dessau/work/bilder/logos/spk-logo-druck.png
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 110d924e401524bb2135f6ddb843198e99a331f27258d52148a55df99e718d10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:10 GMT
Last-Modified: Thu, 12 May 2022 22:01:44 GMT
Server: nginx
ETag: "627d83c8-28e0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10464

GET
H/1.1 200
OK 392x696bb.png
sparka-kundentermin2022.com/ 59 KB
59 KB 151ms
71ms Image
image/png 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/392x696bb.png
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 0df49764e93dcf8428f964409c7f0bc600f18981ee3e1ebf251bed1d3932d1aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Fri, 13 May 2022 19:44:55 GMT
Server: nginx
ETag: "627eb537-ec49"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 60489

GET
H/1.1 200
OK 1640088281840.png
sparka-kundentermin2022.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award/image.img.png/ 3 KB
3 KB 117ms
37ms Image
image/png 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award/image.img.png/1640088281840.png
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: bc4b0c1b29bfc9a420b7a21150a764688407e7bc3c976cf62b1dec5237a13e99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Fri, 13 May 2022 07:26:28 GMT
Server: nginx
ETag: "627e0824-a34"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2612

GET
H/1.1 200
OK 1640088282484.png
sparka-kundentermin2022.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/ 13 KB
13 KB 160ms
75ms Image
image/png 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/1640088282484.png
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 4eb2b7ffbc2e18601e1146e12ccb7f4b79b41e931cb03679cc6d4c15dc3ac63e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Fri, 13 May 2022 07:26:28 GMT
Server: nginx
ETag: "627e0824-3477"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13431

GET
H2 200 jquery-ui.js Show response
code.jquery.com/ui/1.13.1/ 517 KB
124 KB 24ms
24ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.13.1/jquery-ui.js
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Sun, 29 May 2022 09:17:10 GMT
content-encoding: gzip
last-modified: Thu, 20 Jan 2022 14:12:59 GMT
server: nginx
etag: W/"61e96deb-812a6"
vary: Accept-Encoding
x-hw: 1653815830.dop130.fr8.t,1653815830.cds203.fr8.hn,1653815830.cds242.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 126241

GET
H/1.1 200
OK Sparkasse_web_Rg.woff
sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 41 KB
41 KB 47ms
41ms Font
application/font-woff 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Rg.woff
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451

Request headers

Referer: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Origin: https://sparka-kundentermin2022.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:10 GMT
Last-Modified: Fri, 13 May 2022 12:40:24 GMT
Server: nginx
ETag: "627e51b8-a200"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 41472

GET
H/1.1 200
OK pictos-if.woff
sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 197 KB
198 KB 69ms
38ms Font
application/font-woff 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/pictos-if.woff
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: 385bbee80414712855e9a4250cd4dcbbff192dc79136cf99fa5b62075d3bb0ad

Request headers

Referer: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Origin: https://sparka-kundentermin2022.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Fri, 13 May 2022 12:40:24 GMT
Server: nginx
ETag: "627e51b8-315c8"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 202184

GET
H/1.1 200
OK Sparkasse_web_Bd.woff
sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 36 KB
36 KB 54ms
41ms Font
application/font-woff 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Bd.woff
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002

Request headers

Referer: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Origin: https://sparka-kundentermin2022.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Fri, 13 May 2022 12:40:24 GMT
Server: nginx
ETag: "627e51b8-901c"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 36892

GET
H/1.1 200
OK SparkasseHead_web_Rg.woff
sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 29 KB
30 KB 38ms
38ms Font
application/font-woff 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale/fonts/SparkasseHead_web_Rg.woff
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86

Request headers

Referer: https://sparka-kundentermin2022.com/etc/clientlibs/myif/master/base/internetfiliale.min.css
Origin: https://sparka-kundentermin2022.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Fri, 13 May 2022 12:41:30 GMT
Server: nginx
ETag: "627e51fa-7550"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30032

GET
H/1.1 200
OK 1608194651895.jpg
sparka-kundentermin2022.com/ 117 KB
117 KB 38ms
38ms Image
image/jpeg 85.193.88.237
TIMEWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparka-kundentermin2022.com/1608194651895.jpg
Requested by: Host: sparka-kundentermin2022.com
URL: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 85.193.88.237 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS: 910845-cj36302.tmweb.ru
Software: nginx /
Resource Hash: e7ae4d3aa60ef6c112d92d36ade9da9a057992e855aa5eb9d327050c7b3d6d1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sparka-kundentermin2022.com/TT1EHQYUCS?87550957314
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Sun, 29 May 2022 09:17:11 GMT
Last-Modified: Sat, 14 May 2022 06:34:41 GMT
Server: nginx
ETag: "627f4d81-1d418"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 119832

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.bf/	1970-01-20 12:53:22	Name: __Secure-ENID Value: 5.SE=eqjZhOIZrK6GDlyN0YPTIIdYrqpvc9MVeEsBTe5pSLN1Pf7NIJfKqq1vbdtdjnA0fscdk4bEMG4opKd95xiTIJWH0rGXVztB0MY6cqPvBmNjLsM_xC32J3UdvNBLnq7wuqqsUbDCozblwBDZgblYxfGeuVgJONbIjOjUHQaepro
.google.bf/	1970-01-20 20:54:47	Name: CONSENT Value: PENDING+102
sparka-kundentermin2022.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 47gi5pq0orsk6iu9gfd76jimp5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
sparka-kundentermin2022.com
www.google.bf
2001:4de0:ac18::1:a:3a
2a00:1450:4001:82f::2003
85.193.88.237
0df49764e93dcf8428f964409c7f0bc600f18981ee3e1ebf251bed1d3932d1aa
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451
110d924e401524bb2135f6ddb843198e99a331f27258d52148a55df99e718d10
2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a
385bbee80414712855e9a4250cd4dcbbff192dc79136cf99fa5b62075d3bb0ad
4eb2b7ffbc2e18601e1146e12ccb7f4b79b41e931cb03679cc6d4c15dc3ac63e
58a6f49e92f7d2fd1246d98c568c2ac7d6be832ddfece67ec9f7ef3332766adf
5aee45746484b27e97c461327fe8bf4e6ee210ea4071845ec759a86fc2142353
80aeb0da8af66eee8e280ad954dbeae4acc943c9cbd46f5d7f5d9d86cde702df
9458c9806502a7e9c0e8b5bf28f6b26a07548e36882e75c16d6986e8b164ba80
a914f6b586a82a465b80ad4eff1132f00307932841c2e785541c0e5eb5f3a4ef
bc4b0c1b29bfc9a420b7a21150a764688407e7bc3c976cf62b1dec5237a13e99
e7ae4d3aa60ef6c112d92d36ade9da9a057992e855aa5eb9d327050c7b3d6d1a
e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276
e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002
eb31deaf233ffa53656dde832c5967b51d0ce12ca5d4f5809f4116a02dfabe1b
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86

sparka-kundentermin2022.com Open in urlscan Pro 85.193.88.237 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

2649 kBTransfer

3129 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

40 JavaScript Global Variables

3 Cookies

Security Headers

Indicators

sparka-kundentermin2022.com Open in urlscan Pro
85.193.88.237 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

2649 kB
Transfer

3129 kB
Size

3
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!