vr-online.top Open in urlscan Pro
104.223.118.73 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.google.ga/url?q=%68%74%74%70%73%3A%2F%2F%61%73%6b%34%70%68%6f%74%6f%2e%69%6e%66%6f%2F%76%72%3F%71%3D%31%33...
Effective URL:
https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Submission: On August 16 via manual (August 16th 2022, 11:04:32 am UTC) from DE — Scanned from DE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 19 HTTP transactions. The main IP is 104.223.118.73, located in Secaucus, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is vr-online.top.
TLS certificate: Issued by R3 on August 15th 2022. Valid for: 3 months.

This is the only time vr-online.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Volksbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1 2	31.41.244.184 31.41.244.184	50215 (MASTERMSK-AS) (MASTERMSK-AS)
1 17	104.223.118.73 104.223.118.73	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
1	194.149.254.19 194.149.254.19	15590 (ATRUVIA) (ATRUVIA)
19	4

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.41.244.184 (Russian Federation) 1 redirects

ASN50215 (MASTERMSK-AS, RU)

ask4photo.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.223.118.73 (Secaucus, United States) 1 redirects

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 104.223.118.73.static.quadranet.com

vr-online.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.149.254.19 (Germany)

ASN15590 (ATRUVIA, DE)

www.vb-bochumwitten.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	vr-online.top 1 redirects vr-online.top	1 MB
2	ask4photo.info 1 redirects ask4photo.info	735 B
1	vb-bochumwitten.de www.vb-bochumwitten.de	25 KB
1	google.ga www.google.ga — Cisco Umbrella Rank: 35116	1 KB
19	4

	Domain	Requested by
17	vr-online.top	1 redirects ask4photo.info vr-online.top
2	ask4photo.info	1 redirects www.google.ga
1	www.vb-bochumwitten.de	vr-online.top
1	www.google.ga
19	4

This site contains no links.

Subject Issuer	Validity	Valid
*.google.ga GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
ask4photo.info R3	`2022-08-11` - `2022-11-09`	3 months	crt.sh
vr-online.top R3	`2022-08-15` - `2022-11-13`	3 months	crt.sh
vb-bochumwitten.de QuoVadis Europe EV SSL CA G1	`2022-07-14` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Frame ID: 28E2843970320C3EF27637FEBE146702
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anmelden - Volksbank

Page URL History Show full URLs

https://www.google.ga/url?q=%68%74%74%70%73%3A%2F%2F%61%73%6b%34%70%68%6f%74%6f%2e%69%6e%66%6f%2F%... Page URL
https://ask4photo.info/vr?q=13947495529 HTTP 302
https://ask4photo.info/rlogin.php?page=u2 Page URL
https://vr-online.top/rlogin.php?page=u2 HTTP 302
https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1380 kB
Transfer

1374 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.google.ga/url?q=%68%74%74%70%73%3A%2F%2F%61%73%6b%34%70%68%6f%74%6f%2e%69%6e%66%6f%2F%76%72%3F%71%3D%31%33%39%34%37%34%39%35%35%32%39&sa=D&sntz=1&usg=AOvVaw0WxxPdiJPGhkPdXkLfzSHh Page URL
https://ask4photo.info/vr?q=13947495529 HTTP 302
https://ask4photo.info/rlogin.php?page=u2 Page URL
https://vr-online.top/rlogin.php?page=u2 HTTP 302
https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://ask4photo.info/vr?q=13947495529 HTTP 302
https://ask4photo.info/rlogin.php?page=u2

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 url Show response
www.google.ga/ 376 B
1 KB 69ms
36ms Document
text/html 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.ga/url?q=%68%74%74%70%73%3A%2F%2F%61%73%6b%34%70%68%6f%74%6f%2e%69%6e%66%6f%2F%76%72%3F%71%3D%31%33%39%34%37%34%39%35%35%32%39&sa=D&sntz=1&usg=AOvVaw0WxxPdiJPGhkPdXkLfzSHh

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

3963dd20bd0bec07d740d7df45d4f069300e236f2174ab4d95319ecba6444ceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bfcache-opt-in: unload
cache-control: private
content-length: 376
content-type: text/html; charset=UTF-8
date: Tue, 16 Aug 2022 11:04:24 GMT
expires: Tue, 16 Aug 2022 11:04:24 GMT
location: https://ask4photo.info/vr?q=13947495529
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: gws
strict-transport-security: max-age=31536000
x-xss-protection: 0

GET
H/1.1

200
OK

rlogin.php
ask4photo.info/
Redirect Chain

https://ask4photo.info/vr?q=13947495529
https://ask4photo.info/rlogin.php?page=u2

141 B
347 B

55ms
54ms

Document
text/html

31.41.244.184
MASTERMSK-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ask4photo.info/rlogin.php?page=u2
Requested by: Host: www.google.ga
URL: https://www.google.ga/url?q=%68%74%74%70%73%3A%2F%2F%61%73%6b%34%70%68%6f%74%6f%2e%69%6e%66%6f%2F%76%72%3F%71%3D%31%33%39%34%37%34%39%35%35%32%39&sa=D&sntz=1&usg=AOvVaw0WxxPdiJPGhkPdXkLfzSHh
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 31.41.244.184 , Russian Federation, ASN50215 (MASTERMSK-AS, RU),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.google.ga/url?q=%68%74%74%70%73%3A%2F%2F%61%73%6b%34%70%68%6f%74%6f%2e%69%6e%66%6f%2F%76%72%3F%71%3D%31%33%39%34%37%34%39%35%35%32%39&sa=D&sntz=1&usg=AOvVaw0WxxPdiJPGhkPdXkLfzSHh
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 16 Aug 2022 11:04:24 GMT
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked

Redirect headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 16 Aug 2022 11:04:24 GMT
Location: /rlogin.php?page=u2
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H/1.1

200
OK

Primary Request postcode.php Show response
vr-online.top/services_auth/auth-ui/
Redirect Chain

https://vr-online.top/rlogin.php?page=u2
https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2

911 KB
912 KB

1225ms
1225ms

Document
text/html

104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Requested by: Host: ask4photo.info
URL: https://ask4photo.info/rlogin.php?page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 / PHP/5.4.16
Resource Hash: e64508313767acdee299c086672254aad72e3cf3d7bef115e84ec5300f0399c1

Request headers

Referer: https://ask4photo.info/rlogin.php?page=u2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Tue, 16 Aug 2022 11:04:25 GMT
Server: nginx/1.20.1
Transfer-Encoding: chunked
X-Powered-By: PHP/5.4.16

Redirect headers

Connection: keep-alive
Content-Length: 108
Content-Type: text/html; charset=utf-8
Date: Tue, 16 Aug 2022 11:04:24 GMT
Server: nginx/1.20.1
X-Powered-By: PHP/5.4.16
location: services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2

GET
H/1.1 200
OK styles.css
vr-online.top/services_auth/auth-ui/index_files/ 31 KB
32 KB 600ms
423ms Stylesheet
text/css 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/styles.css
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: a86a9983fccbe3bbe93093b302023ebfa2564f9c7dd2adc1d8d65e3cc12fe13f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "7d0c-5e42c02ba21c0"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32012

GET
H/1.1 200
OK jquery-1.12.2.min.js Show response
vr-online.top/services_auth/auth-ui/ 95 KB
95 KB 599ms
422ms Script
application/javascript 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/services_auth/auth-ui/jquery-1.12.2.min.js
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Mon, 04 Jul 2022 02:11:52 GMT
Server: nginx/1.20.1
ETag: "17bdc-5e2f1425dea00"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 97244

GET
H2 200 Logo%20VB%20Bochum%20Witten%20eG%20transparent%20450x50.png
www.vb-bochumwitten.de/content/f4129-0/internetneu_1/konfiguration/website/_jcr_content/banklogo/banklogoGross.img.png/1504510792018/ 24 KB
25 KB 110ms
17ms Image
image/png 194.149.254.19
ATRUVIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.vb-bochumwitten.de/content/f4129-0/internetneu_1/konfiguration/website/_jcr_content/banklogo/banklogoGross.img.png/1504510792018/Logo%20VB%20Bochum%20Witten%20eG%20transparent%20450x50.png

Requested by

Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.149.254.19 , Germany, ASN15590 (ATRUVIA, DE),

Reverse DNS

Software

Resource Hash

f1c8533e90e95aff556ce0e69897101803aa48c9b6a6f235c26d7944cbdd9f4a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self'
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 04 Sep 2017 07:39:52 GMT
age: 18
date: Tue, 16 Aug 2022 11:04:09 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
x-oneagent-js-injection: true
x-xss-protection: 1; mode=block
cache-control: max-age=1209600, stale-if-error=3600, stale-while-revalidate=3600, public, must-revalidate
strict-transport-security: max-age=31536000
content-length: 24538
x-content-type-options: nosniff

GET
H/1.1 200
OK ukraine_flag_548_348.jpg
vr-online.top/services_auth/auth-ui/index_files/ 24 KB
24 KB 323ms
322ms Image
image/jpeg 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/ukraine_flag_548_348.jpg
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: a105545eba0d05192b8328cded8239f5755a4027c5e227d50fe75f30ef6d8380

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Fri, 22 Jul 2022 16:14:50 GMT
Server: nginx/1.20.1
ETag: "5f34-5e4672231b280"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24372

GET
H/1.1 200
OK SchwaebischHall.png
vr-online.top/services_auth/auth-ui/index_files/ 4 KB
4 KB 266ms
253ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/SchwaebischHall.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 7b80565005aab705788b217adbb52b163ae2efdf99fe81ee9d89f91e415e34af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "10cf-5e42c02ba21c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4303

GET
H/1.1 200
OK UnionInvestment.png
vr-online.top/services_auth/auth-ui/index_files/ 6 KB
6 KB 431ms
255ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/UnionInvestment.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 93a42951ec0bae1d49c6c94e2bcac1a728591b5aee96a698aeb95c569aa4ce47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "17fe-5e42c02ba21c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6142

GET
H/1.1 200
OK RundV.png
vr-online.top/services_auth/auth-ui/index_files/ 5 KB
5 KB 422ms
243ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/RundV.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 33891c62b6270b0139750f3be423eb7c4807121d5ce7d54699a97ff5ada20bfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:38 GMT
Server: nginx/1.20.1
ETag: "1335-5e42c02aadf80"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4917

GET
H/1.1 200
OK DZBANK_Initiativbank.png
vr-online.top/services_auth/auth-ui/index_files/ 16 KB
17 KB 592ms
426ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/DZBANK_Initiativbank.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 60154e6e2f54fa24a52d92b99146a39d81151578f6a3a4bd533bf8c43d676b6c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "4194-5e42c02ba21c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16788

GET
H/1.1 200
OK DZPrivatbank.png
vr-online.top/services_auth/auth-ui/index_files/ 3 KB
3 KB 244ms
244ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/DZPrivatbank.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: bc5bcd93361b2057348129acae6936f5ef20d5b31cebb08a03abdf23a4cb5168

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "c12-5e42c02ba21c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3090

GET
H/1.1 200
OK VR_Smart_Finanz.png
vr-online.top/services_auth/auth-ui/index_files/ 4 KB
4 KB 611ms
251ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/VR_Smart_Finanz.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 3097e43e3a9b2002798fa0cee854002a72f17f43103a9ea7b4dedef610a0f5d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:27 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "e8f-5e42c02ba21c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3727

GET
H/1.1 200
OK DGHYP.png
vr-online.top/services_auth/auth-ui/index_files/ 2 KB
2 KB 432ms
243ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/DGHYP.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: 193c842a2509cf7f02ae53bcfe06eef90e653f86af7b973bce4059eae10e92f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:39 GMT
Server: nginx/1.20.1
ETag: "75b-5e42c02ba21c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1883

GET
H/1.1 200
OK MnchenerHyp.png
vr-online.top/services_auth/auth-ui/index_files/ 6 KB
6 KB 433ms
244ms Image
image/png 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-online.top/services_auth/auth-ui/index_files/MnchenerHyp.png
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: f00e05e6fcb48cbf33e15e7393b71041234246e48727fc225310c153cfa6cc31

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Tue, 19 Jul 2022 17:42:38 GMT
Server: nginx/1.20.1
ETag: "16ae-5e42c02aadf80"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5806

GET
H/1.1 200
OK FrutigerVR-Bold_hinted.woff2
vr-online.top/services_auth/auth-ui/fonts/ 24 KB
24 KB 441ms
408ms Font
application/octet-stream 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/services_auth/auth-ui/fonts/FrutigerVR-Bold_hinted.woff2
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: c825e9b517a70daf14196922b7c35578f62e5facea44a808acf4dadda1456b85

Request headers

Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Origin: https://vr-online.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Fri, 22 Jul 2022 16:20:09 GMT
Server: nginx/1.20.1
Connection: keep-alive
Accept-Ranges: bytes
ETag: "6004-5e46735354040"
Content-Length: 24580

GET
H/1.1 200
OK FrutigerVR-Regular_hinted.woff2
vr-online.top/services_auth/auth-ui/fonts/ 24 KB
24 KB 425ms
333ms Font
application/octet-stream 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/services_auth/auth-ui/fonts/FrutigerVR-Regular_hinted.woff2
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: af04aec736c43b3a1e44614897ae314d3f624fcdc15f6d9749600963b20e4eff

Request headers

Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Origin: https://vr-online.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Fri, 22 Jul 2022 16:17:57 GMT
Server: nginx/1.20.1
Connection: keep-alive
Accept-Ranges: bytes
ETag: "6020-5e4672d571740"
Content-Length: 24608

GET
H/1.1 200
OK kf-icons.woff
vr-online.top/services_auth/auth-ui/fonts/ 195 KB
195 KB 590ms
409ms Font
application/font-woff 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/services_auth/auth-ui/fonts/kf-icons.woff
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 /
Resource Hash: cac9d473a22e9459b05aebf639e15e68521111d7cafa2e30f3b77fd753f8b5e9

Request headers

Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
Origin: https://vr-online.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 16 Aug 2022 11:04:26 GMT
Last-Modified: Fri, 22 Jul 2022 16:31:36 GMT
Server: nginx/1.20.1
ETag: "30b34-5e4675e280a00"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 199476

POST
H/1.1 200
OK ajax.php Show response
vr-online.top/privatkunden/center/ajax/ 0
355 B 663ms
251ms XHR
text/html 104.223.118.73
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-online.top/privatkunden/center/ajax/ajax.php?id=ef132ccbcca611ecaebeb178
Requested by: Host: vr-online.top
URL: https://vr-online.top/services_auth/auth-ui/jquery-1.12.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.223.118.73 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 104.223.118.73.static.quadranet.com
Software: nginx/1.20.1 / PHP/5.4.16
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://vr-online.top/services_auth/auth-ui/postcode.php?id=ef132ccbcca611ecaebeb178&page=u2
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 16 Aug 2022 11:04:27 GMT
Server: nginx/1.20.1
X-Powered-By: PHP/5.4.16
Content-Type: text/html; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Volksbank (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
vr-online.top/services_auth/auth-ui	1970-01-20 14:53:27	Name: uid Value: 610034640
.google.ga/	1970-01-20 14:47:14	Name: __Secure-ENID Value: 6.SE=b-6PEUcUGqiWJItn7ael3hoc2a4AS0ZMOenGO3UDKG9qcIsHxParbnuFxPJnUATK8kQSewQnEkNXej0FTlAL4MmvvzttjSnydAHS2wx4pj2rl_MBSwyrZuPj7RGpgV3ZwvtwjpnfrHgIYbDiFj5jOTeCAalBniMGDyChOo5SKz4
.google.ga/	1970-01-20 14:53:27	Name: CONSENT Value: PENDING+864
ask4photo.info/	1970-01-20 05:18:54	Name: eebe7405eb468350778d52c6a8fd6d80 Value: 0
vr-online.top/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4pjd5t69giobjigm8mefdvo3m7

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ask4photo.info
vr-online.top
www.google.ga
www.vb-bochumwitten.de
104.223.118.73
194.149.254.19
2a00:1450:4001:812::2003
31.41.244.184
193c842a2509cf7f02ae53bcfe06eef90e653f86af7b973bce4059eae10e92f6
3097e43e3a9b2002798fa0cee854002a72f17f43103a9ea7b4dedef610a0f5d6
33891c62b6270b0139750f3be423eb7c4807121d5ce7d54699a97ff5ada20bfb
3963dd20bd0bec07d740d7df45d4f069300e236f2174ab4d95319ecba6444ceb
60154e6e2f54fa24a52d92b99146a39d81151578f6a3a4bd533bf8c43d676b6c
7b80565005aab705788b217adbb52b163ae2efdf99fe81ee9d89f91e415e34af
93a42951ec0bae1d49c6c94e2bcac1a728591b5aee96a698aeb95c569aa4ce47
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
a105545eba0d05192b8328cded8239f5755a4027c5e227d50fe75f30ef6d8380
a86a9983fccbe3bbe93093b302023ebfa2564f9c7dd2adc1d8d65e3cc12fe13f
af04aec736c43b3a1e44614897ae314d3f624fcdc15f6d9749600963b20e4eff
bc5bcd93361b2057348129acae6936f5ef20d5b31cebb08a03abdf23a4cb5168
c825e9b517a70daf14196922b7c35578f62e5facea44a808acf4dadda1456b85
cac9d473a22e9459b05aebf639e15e68521111d7cafa2e30f3b77fd753f8b5e9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64508313767acdee299c086672254aad72e3cf3d7bef115e84ec5300f0399c1
f00e05e6fcb48cbf33e15e7393b71041234246e48727fc225310c153cfa6cc31
f1c8533e90e95aff556ce0e69897101803aa48c9b6a6f235c26d7944cbdd9f4a

vr-online.top Open in urlscan Pro 104.223.118.73 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

1380 kBTransfer

1374 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

5 Cookies

Security Headers

Indicators

vr-online.top Open in urlscan Pro
104.223.118.73 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1380 kB
Transfer

1374 kB
Size

5
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!