![](/screenshots/11fdd2b5-eb80-4133-9164-bcd625e5b737.png)
banking-psd2.com
Open in
urlscan Pro
104.21.14.212
Malicious Activity!
Public Scan
Effective URL: http://banking-psd2.com/?ref=5bJkml3gzXdywGn&direct=neocfzNZS4Y6CFu&privatkunden=7HDLRQ5WkwEmBl9
Submission: On July 21 via manual from IT — Scanned from IT
Summary
This is the only time banking-psd2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking) Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 16 | 104.21.14.212 104.21.14.212 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
banking-psd2.com
2 redirects
banking-psd2.com |
299 KB |
14 | 1 |
Domain | Requested by | |
---|---|---|
16 | banking-psd2.com |
2 redirects
banking-psd2.com
|
14 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://banking-psd2.com/?ref=5bJkml3gzXdywGn&direct=neocfzNZS4Y6CFu&privatkunden=7HDLRQ5WkwEmBl9
Frame ID: 4D3DC34A225FAE4E98C8CE2D49B9E117
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/11fdd2b5-eb80-4133-9164-bcd625e5b737.png)
Page Title
Online LegimitationPage URL History Show full URLs
- http://banking-psd2.com/ Page URL
-
http://banking-psd2.com/cdn-cgi/phish-bypass?atok=pRby..7bL9tKUWdM0MsQv5rWr41i9yUXGoijlFlh.zs-165839...
HTTP 301
http://banking-psd2.com/ HTTP 302
http://banking-psd2.com/?ref=5bJkml3gzXdywGn&direct=neocfzNZS4Y6CFu&privatkunden=7HDLRQ5WkwEmBl9 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://banking-psd2.com/ Page URL
-
http://banking-psd2.com/cdn-cgi/phish-bypass?atok=pRby..7bL9tKUWdM0MsQv5rWr41i9yUXGoijlFlh.zs-1658399680-0-%2F
HTTP 301
http://banking-psd2.com/ HTTP 302
http://banking-psd2.com/?ref=5bJkml3gzXdywGn&direct=neocfzNZS4Y6CFu&privatkunden=7HDLRQ5WkwEmBl9 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
banking-psd2.com/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
banking-psd2.com/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
banking-psd2.com/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
banking-psd2.com/ Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m3da12f45c073a0
banking-psd2.com/ |
279 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mfe8d6126193cfc
banking-psd2.com/ |
94 KB 34 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m014ed06cd8e006
banking-psd2.com/ |
16 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m9c5be21451e109
banking-psd2.com/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mb15a1611297ef1
banking-psd2.com/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mb9d1eee0f1dfbb
banking-psd2.com/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m49681a770f7456
banking-psd2.com/ |
46 KB 17 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m4d759abf0c15b7
banking-psd2.com/ |
39 KB 39 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
md9c025a7de6ca9
banking-psd2.com/ |
48 KB 48 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mbe5795ac94cfb1
banking-psd2.com/ |
39 KB 40 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking) Generic Cloudflare (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery object| deployJava function| Detector function| murmurhash3_32_gc object| swfobject function| ClientJS function| UAParser function| hsave string| s2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.banking-psd2.com/ | Name: __cf_mw_byp Value: pRby..7bL9tKUWdM0MsQv5rWr41i9yUXGoijlFlh.zs-1658399680-0-/ |
|
banking-psd2.com/ | Name: PHPSESSID Value: h7admj04icva0q20db4iu533qn |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
banking-psd2.com
104.21.14.212
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
1274d656998fef0af98e54fba45dcf3f08e0d172c301e46ca0c816353d010502
4055c9311152fa34541d48c15115758932871e92c6023a7d7d986342fcc402ed
4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753
524d24dda421f81aced7f840eeaf693cb7f6ed295b46cd868c8e1291ab5bab1c
56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03
591c48a161f91ce005b11fa41df8645cff1859ae842c615dbcf929cd8ee108f8
622cdddf9135812f42c5b6396df2b08c836819bb84d0bcd9e82e779d0a4ad469
74bcd86bc937c41e4045ef2a14f6619ffc828ceeca96e7c1946330c34abba648
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016