erste-george.meditrans.it
Open in
urlscan Pro
185.2.4.84
Malicious Activity!
Public Scan
URL:
https://erste-george.meditrans.it/at/oauth/erste/
Submission: On January 03 via api from NL — Scanned from IT
Submission: On January 03 via api from NL — Scanned from IT
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 185.2.4.84, located in
Italy and
belongs to REGISTER_UK-AS, IT.
The main domain is erste-george.meditrans.it.
TLS certificate: Issued by R3 on January 2nd 2024. Valid for: 3 months.
This is the only time erste-george.meditrans.it was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 2nd 2024. Valid for: 3 months.
This is the only time erste-george.meditrans.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 185.2.4.84 185.2.4.84 | 203461 (REGISTER_...) (REGISTER_UK-AS) | |
| 3 | 213.150.6.28 213.150.6.28 | 12895 (IT-AUSTRI...) (IT-AUSTRIA Vienna) | |
| 13 | 3 |
10
185.2.4.84
(Italy)
ASN203461 (REGISTER_UK-AS, IT)
PTR: lhcp1084.webapps.net
ASN203461 (REGISTER_UK-AS, IT)
PTR: lhcp1084.webapps.net
| erste-george.meditrans.it |
3
213.150.6.28
(Vienna, Austria)
ASN12895 (IT-AUSTRIA Vienna, Austria, AT)
PTR: login.sparkasse.at
ASN12895 (IT-AUSTRIA Vienna, Austria, AT)
PTR: login.sparkasse.at
| login.sparkasse.at |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
meditrans.it
erste-george.meditrans.it |
477 KB |
| 3 |
sparkasse.at
login.sparkasse.at — Cisco Umbrella Rank: 895985 |
3 KB |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 10 | erste-george.meditrans.it |
erste-george.meditrans.it
|
| 3 | login.sparkasse.at |
erste-george.meditrans.it
|
| 13 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.sparkasse.at |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| erste-george.meditrans.it R3 |
2024-01-02 - 2024-04-01 |
3 months | crt.sh |
| login.sparkasse.at DigiCert EV RSA CA G2 |
2023-03-16 - 2024-03-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://erste-george.meditrans.it/at/oauth/erste/
Frame ID: 78C1CCBE539366F817C014D5FAA81B02
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Erste Bank und Sparkassen IdentifikationPage Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.sparkasse.at/cookies
Title: hier
Title: hier
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
erste-george.meditrans.it/at/oauth/erste/ |
107 KB 107 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lib.css
erste-george.meditrans.it/at/oauth/erste/files/ |
93 KB 93 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gWqvRrszL2yz5NLdR4kW.js.download
erste-george.meditrans.it/at/oauth/erste/files/ |
220 KB 220 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Doppel-Logo_o_Claim.svg
erste-george.meditrans.it/at/oauth/erste/files/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
George-symbol.svg
erste-george.meditrans.it/at/oauth/erste/files/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bankcard.gif
erste-george.meditrans.it/at/oauth/erste/files/ |
49 KB 49 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Regular-webfont.woff
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Semibold-webfont.woff
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Semibold-webfont.ttf
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Regular-webfont.ttf
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
119 B 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
60 B 991 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
0 803 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)40 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| keepalive function| setupKeepaliveInterval number| FLIP_ICON_HEIGHT undefined| myWindow function| sumNumbers function| doRwd function| removeEmptyIEAlertPadding function| calcCol2Height function| calcVisibleWhiteboxHeight function| centerpage function| confirmmsg function| windowtracker function| $ function| jQuery object| reWhiteSpace function| Utf8Encode function| htmlToJsConversion function| nbalert function| setFldFocus function| isWhiteSpace function| isEmpty function| doDisableSpecifiedForm function| doSubmitAndDisable function| jsxEncrypt function| encodeToHex object| STS object| STSSecAppSecondfactor function| setFocus function| displayError function| checkUser function| submitCredentials function| submitCancelLoginForm object| STSCookieBanner boolean| ajax_disabled object| webinject_config string| eventObf function| cls undefined| unload_backup_handler object| w2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| erste-george.meditrans.it/ | Name: 4G0qy9fDDI Value: kq7ktZzFXAzgbSaRYUpaS3gZ8W9YwqRu |
|
| erste-george.meditrans.it/ | Name: NHIJACZdcO Value: 31X09t9B0foJ4KC55Oql83AyY7xH3kOr |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
erste-george.meditrans.it
login.sparkasse.at
185.2.4.84
213.150.6.28
04cf169a10f64a9ce6b5650e37e047651690b18b238e1f431636aa292d6fb600
0e6a600e56c051d8db400fb4e377807511fd627b8f5be37555bf11cf9918a3ba
33c92b84a8def0944952bce1bfaf08ada7f933a410685460789abf6fb46715a7
48c24fd8fb19b02949a64918eb768e58dbe70210ad7de1f7f78dfc0052dfde82
b0f484443bd01c61cebbfb1c3abe4a253e3a0c314150025521712fefc3284224
b8bb52fdbcbdc0b034daee432a3eb2f3232cb0ba16a3eb527bae55cdbc4aaa96
d63b87f6b35187a37eb81f9a81f5b52cf33be43e1735da20d838ab8fd82fdd33
e34c8160af7218c7fe6fa2a1eaabda452c31e5ba2495e9bb136ccfdf80ed9093
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef64cd6986101c72aa777e43872496157ecd23f9dc4770b00f47b9b4bf126f20