vapemallow.com Open in urlscan Pro
46.254.36.20 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wijnants.info/fsvz
Effective URL:
https://vapemallow.com/dkb.de/auth/login.php
Submission Tags: falconsandbox
Submission: On December 13 via api (December 13th 2022, 12:59:23 am UTC) from US — Scanned from DE

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 46.254.36.20, located in Rome, Italy and belongs to SERVERPLAN-AS, IT. The main domain is vapemallow.com.
TLS certificate: Issued by R3 on November 19th 2022. Valid for: 3 months.

This is the only time vapemallow.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	185.58.96.92 185.58.96.92	39923 (AS-UNIXSO...) (AS-UNIXSOLUTIONS Unix-Solutions Network)
1 6	46.254.36.20 46.254.36.20	52030 (SERVERPLA...) (SERVERPLAN-AS)
5	2

2 185.58.96.92 (Antwerp, Belgium) 2 redirects

ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE)
PTR: web2.gigaserving.com

wijnants.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 46.254.36.20 (Rome, Italy) 1 redirects

ASN52030 (SERVERPLAN-AS, IT)
PTR: v012on-vm.sphostserver.com

vapemallow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	vapemallow.com 1 redirects vapemallow.com	213 KB
2	wijnants.info 2 redirects wijnants.info	652 B
5	2

	Domain	Requested by
6	vapemallow.com	1 redirects vapemallow.com
2	wijnants.info	2 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
vapemallow.com R3	`2022-11-19` - `2023-02-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://vapemallow.com/dkb.de/auth/login.php
Frame ID: 68B868D247C6CC2734DD03AF500194F9
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DKB - Deutsche Kreditbank AG - Internet Banking

Page URL History Show full URLs

http://wijnants.info/fsvz HTTP 301
http://wijnants.info/fsvz/ HTTP 302
https://vapemallow.com/dkb.de/ HTTP 302
https://vapemallow.com/dkb.de/auth/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

212 kB
Transfer

924 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wijnants.info/fsvz HTTP 301
http://wijnants.info/fsvz/ HTTP 302
https://vapemallow.com/dkb.de/ HTTP 302
https://vapemallow.com/dkb.de/auth/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response vapemallow.com/dkb.de/auth/ Redirect Chain http://wijnants.info/fsvz http://wijnants.info/fsvz/ https://vapemallow.com/dkb.de/ https://vapemallow.com/dkb.de/auth/login.php	30 KB 6 KB	194ms 194ms	Document text/html	46.254.36.20 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://vapemallow.com/dkb.de/auth/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.254.36.20 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS v012on-vm.sphostserver.com Software Apache / PHP/7.3.33 PleskLin Resource Hash `b34571e3d08800133f2f99bdd89b9367d42fe1ca5a6203d3b907f17df88a830f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 5667 Content-Type text/html; charset=UTF-8 Date Tue, 13 Dec 2022 00:59:19 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Referrer-Policy Server Apache Vary Accept-Encoding X-Powered-By PHP/7.3.33 PleskLin Redirect headers Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Tue, 13 Dec 2022 00:59:18 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Location auth/login.php Pragma no-cache Referrer-Policy Server Apache X-Powered-By PHP/7.3.33 PleskLin
GET H/1.1	200 OK	global.css vapemallow.com/dkb.de/auth/files/css/	237 KB 42 KB	60ms 59ms	Stylesheet text/css	46.254.36.20 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://vapemallow.com/dkb.de/auth/files/css/global.css Requested by Host: vapemallow.com URL: https://vapemallow.com/dkb.de/auth/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.254.36.20 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS v012on-vm.sphostserver.com Software Apache / W3 Total Cache/2.2.6 Resource Hash `6f7e37273fe0e0310c8a491decebfc3a97f48f5d26982f34e7c1353ce1930661` Request headers accept-language de-DE,de;q=0.9 Referer https://vapemallow.com/dkb.de/auth/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Tue, 13 Dec 2022 00:59:19 GMT Content-Encoding gzip X-Powered-By W3 Total Cache/2.2.6 Connection Keep-Alive Content-Length 42333 Pragma public Referrer-Policy Last-Modified Mon, 12 Dec 2022 05:54:16 GMT Server Apache ETag "3b4e8-5ef9b22380f0e-gzip" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=31536000, public Accept-Ranges bytes Keep-Alive timeout=5, max=98 Expires Wed, 13 Dec 2023 00:59:19 GMT
GET H/1.1	200 OK	responsive.min.css vapemallow.com/dkb.de/auth/files/css/	601 KB 117 KB	152ms 59ms	Stylesheet text/css	46.254.36.20 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://vapemallow.com/dkb.de/auth/files/css/responsive.min.css Requested by Host: vapemallow.com URL: https://vapemallow.com/dkb.de/auth/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.254.36.20 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS v012on-vm.sphostserver.com Software Apache / W3 Total Cache/2.2.6 Resource Hash `84ceb28d811d91ca06987031548f3f32a860ebd7206bc0d3c2ebd2684ababd97` Request headers accept-language de-DE,de;q=0.9 Referer https://vapemallow.com/dkb.de/auth/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Tue, 13 Dec 2022 00:59:19 GMT Content-Encoding gzip X-Powered-By W3 Total Cache/2.2.6 Transfer-Encoding chunked Connection Keep-Alive Pragma public Referrer-Policy Last-Modified Mon, 12 Dec 2022 05:54:16 GMT Server Apache ETag "9647d-5ef9b22381eae-gzip" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=31536000, public Accept-Ranges bytes Keep-Alive timeout=5, max=100 Expires Wed, 13 Dec 2023 00:59:19 GMT
GET H/1.1	200 OK	cf318495924471a0f48394a91edef30d.jpg vapemallow.com/dkb.de/auth/files/img/	19 KB 20 KB	142ms 49ms	Image image/jpeg	46.254.36.20 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Show image Full URL https://vapemallow.com/dkb.de/auth/files/img/cf318495924471a0f48394a91edef30d.jpg Requested by Host: vapemallow.com URL: https://vapemallow.com/dkb.de/auth/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.254.36.20 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS v012on-vm.sphostserver.com Software Apache / W3 Total Cache/2.2.6 Resource Hash `d364f8c877649738183736979f77804f29d3442f81d84ae6bd7d267af56907e4` Request headers accept-language de-DE,de;q=0.9 Referer https://vapemallow.com/dkb.de/auth/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Tue, 13 Dec 2022 00:59:19 GMT X-Powered-By W3 Total Cache/2.2.6 Connection Keep-Alive Content-Length 19924 Pragma public Referrer-Policy Last-Modified Mon, 12 Dec 2022 05:54:16 GMT Server Apache ETag "4dd4-5ef9b2238267e" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=31536000, public Accept-Ranges bytes Link <https://vapemallow.com/dkb.de/auth/files/img/cf318495924471a0f48394a91edef30d.jpg>; rel="canonical" Keep-Alive timeout=5, max=100 Expires Wed, 13 Dec 2023 00:59:19 GMT
GET H/1.1	200 OK	large.jpg vapemallow.com/dkb.de/auth/files/img/	26 KB 27 KB	147ms 51ms	Image image/jpeg	46.254.36.20 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Show image Full URL https://vapemallow.com/dkb.de/auth/files/img/large.jpg Requested by Host: vapemallow.com URL: https://vapemallow.com/dkb.de/auth/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.254.36.20 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS v012on-vm.sphostserver.com Software Apache / W3 Total Cache/2.2.6 Resource Hash `4f089d9911784e1253afaf5102932887ff2dbb1577d13ccae8d1f4cd8461c780` Request headers accept-language de-DE,de;q=0.9 Referer https://vapemallow.com/dkb.de/auth/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Date Tue, 13 Dec 2022 00:59:19 GMT X-Powered-By W3 Total Cache/2.2.6 Connection Keep-Alive Content-Length 27038 Pragma public Referrer-Policy Last-Modified Mon, 12 Dec 2022 05:54:16 GMT Server Apache ETag "699e-5ef9b22382a66" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=31536000, public Accept-Ranges bytes Link <https://vapemallow.com/dkb.de/auth/files/img/large.jpg>; rel="canonical" Keep-Alive timeout=5, max=100 Expires Wed, 13 Dec 2023 00:59:19 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	208 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	948 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0fe9650923b3c4d5d1b829c47a2a4eb9b6931a06132036a02c570e355f53ec87` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	846 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DKB (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wijnants.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: 87e516dcc8c9cb350ce4fe1b289654a2
			vapemallow.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: akgr0s46gdag4t0h79v12sglgt

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	error	Message: Failed to set referrer policy: The value '' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'origin', 'origin-when-cross-origin', 'same-origin', 'strict-origin', 'strict-origin-when-cross-origin', or 'unsafe-url'. The referrer policy has been left unchanged.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

vapemallow.com
wijnants.info
185.58.96.92
46.254.36.20
0fe9650923b3c4d5d1b829c47a2a4eb9b6931a06132036a02c570e355f53ec87
3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0
4f089d9911784e1253afaf5102932887ff2dbb1577d13ccae8d1f4cd8461c780
5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
6f7e37273fe0e0310c8a491decebfc3a97f48f5d26982f34e7c1353ce1930661
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
84ceb28d811d91ca06987031548f3f32a860ebd7206bc0d3c2ebd2684ababd97
b34571e3d08800133f2f99bdd89b9367d42fe1ca5a6203d3b907f17df88a830f
d364f8c877649738183736979f77804f29d3442f81d84ae6bd7d267af56907e4

vapemallow.com Open in urlscan Pro 46.254.36.20 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

212 kBTransfer

924 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

vapemallow.com Open in urlscan Pro
46.254.36.20 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

212 kB
Transfer

924 kB
Size

2
Cookies

5 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!