dkbb-login-kho999wz.fuettertdasnetz.de Open in urlscan Pro
80.94.95.113 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/
Effective URL:
https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php
Submission: On April 03 via api (April 3rd 2023, 5:03:23 pm UTC) from JP — Scanned from DE

Summary HTTP 7 Redirects Links 33 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 80.94.95.113, located in Romania and belongs to SS-NET, BG. The main domain is dkbb-login-kho999wz.fuettertdasnetz.de.
TLS certificate: Issued by R3 on April 3rd 2023. Valid for: 3 months.

This is the only time dkbb-login-kho999wz.fuettertdasnetz.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 8	80.94.95.113 80.94.95.113		204428 (SS-NET) (SS-NET)
7	2

8 80.94.95.113 (Romania) 1 redirects

ASN204428 (SS-NET, BG)

dkbb-login-kho999wz.fuettertdasnetz.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	fuettertdasnetz.de 1 redirects dkbb-login-kho999wz.fuettertdasnetz.de	483 KB
7	1

	Domain	Requested by
8	dkbb-login-kho999wz.fuettertdasnetz.de	1 redirects dkbb-login-kho999wz.fuettertdasnetz.de
7	1

This site contains links to these domains. Also see Links.

Domain
bank.dkb.de
freundewerben.dkb.de
www.facebook.com
www.instagram.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.tiktok.com
treuhand.dkb.de
finanzwissen.dkb.de

Subject Issuer	Validity	Valid
dkkb-portal-uid009293i.from-wa.com R3	`2023-04-03` - `2023-07-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php
Frame ID: 2A7A4CD9099B8726E65218688383E54E
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DKB - Deutsche Kreditbank AG - Internet Banking

Page URL History Show full URLs

https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/ HTTP 302
https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

483 kB
Transfer

2233 kB
Size

5
Cookies

33 Outgoing links

These are links going to different origins than the main page.

URL: https://bank.dkb.de/privatkunden/girokonto/aktivstatus
Title: Aktivkundenvorteile

Search URL Search Domain Scan URL

URL: https://freundewerben.dkb.de/
Title: Freunde werben

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/girokonto
Title: Girokonto

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/karten
Title: Karten

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/sparen
Title: Sparen

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/investieren
Title: Investieren

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/kredite
Title: Kredite

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/baufinanzierung
Title: Baufinanzierung

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/zusatzleistungen
Title: Zusatzleistungen

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/service
Title: Services

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/geschaeftskunden
Title: Geschäftskunden

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/nachhaltigkeit
Title: Nachhaltigkeit

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/ueber-uns
Title: Über uns

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/karriere
Title: Karriere

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Deutsche.Kreditbank
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/dkb.de/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.twitter.com/dkb_de
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/DeutscheKreditbankAG
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/dkb
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@dkb_whatthecash
Title: TikTok

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/karten/visa-kreditkarte
Title: Kreditkarte

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/investieren/depot
Title: Online-Depot

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/kredite/privatkredit
Title: Privatkredit

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/girokonto/studierendenkonto
Title: Studierendenkonto

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/geschaeftskunden/konto-anlage/geschaeftskonto
Title: Geschäftskonto

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/girokonto/banking-app
Title: DKB-Apps

Search URL Search Domain Scan URL

URL: https://treuhand.dkb.de/thk/?referer=vwpf
Title: Verwalterplattform

Search URL Search Domain Scan URL

URL: https://treuhand.dkb.de/thk/?referer=thpf
Title: Treuhänderplattform

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/service/sicherheit-banking
Title: Sicherheit im Banking

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/karten/visa-secure
Title: Visa Secure

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/karten/card-control
Title: Card Control

Search URL Search Domain Scan URL

URL: https://finanzwissen.dkb.de/
Title: Finanzwissen

Search URL Search Domain Scan URL

URL: https://bank.dkb.de/privatkunden/service/geldautomatensuche
Title: Geldautomaten suchen

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/ HTTP 302
https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
12 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/ Redirect Chain https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/ https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php	59 KB 8 KB	31ms 31ms	Document text/html	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `843ee8b9041e28bc9852791e3860dceef0473fe3c598561c2a779039a9c46314` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 8329 Content-Type text/html; charset=UTF-8 Date Mon, 03 Apr 2023 17:03:18 GMT Keep-Alive timeout=5, max=99 Server Apache/2.4.41 (Ubuntu) Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 03 Apr 2023 17:03:18 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.41 (Ubuntu) location cea9f56c7aedf47de126d0a858cf3bc1/login.php
GET H/1.1	200 OK	dkb-globalfcca.css dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/	237 KB 42 KB	38ms 38ms	Stylesheet text/css	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/dkb-globalfcca.css?etag=9b9a5402bfdca7a80bdfde84cf57e86abb3d47e1 Requested by Host: dkbb-login-kho999wz.fuettertdasnetz.de URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `f3dc30601426f91d05074617d2e242b7662e707faf30833effe76e5a1037f262` Request headers accept-language de-DE,de;q=0.9 Referer https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 17:03:18 GMT Content-Encoding gzip Last-Modified Mon, 03 Apr 2023 17:03:18 GMT Server Apache/2.4.41 (Ubuntu) ETag W/"3b526-5f8718913fb35-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 42349
GET H/1.1	404 Not Found	ruxitagentjs_ICA2NVfhjqrux_10255221104040649.js dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/	0 0	91ms 33ms	Script text/html	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/ruxitagentjs_ICA2NVfhjqrux_10255221104040649.js Requested by Host: dkbb-login-kho999wz.fuettertdasnetz.de URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 17:03:18 GMT Server Apache/2.4.41 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 301 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	dkb_responsive.minc5ca.css dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/responsive/scss_generated/	601 KB 117 KB	111ms 55ms	Stylesheet text/css	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/responsive/scss_generated/dkb_responsive.minc5ca.css?etag=9cf09f16 Requested by Host: dkbb-login-kho999wz.fuettertdasnetz.de URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `8dfe4af08e7abe58787bf375277639ec3ff64797695739eb0d95d703021d1362` Request headers accept-language de-DE,de;q=0.9 Referer https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 17:03:18 GMT Content-Encoding gzip Last-Modified Mon, 03 Apr 2023 17:03:18 GMT Server Apache/2.4.41 (Ubuntu) ETag W/"9658b-5f87189141a75-gzip" Vary Accept-Encoding Transfer-Encoding chunked Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	product-global594f.js Show response dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/	537 KB 139 KB	123ms 62ms	Script application/javascript	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/product-global594f.js?etag=947c864c1d1c7a445b6aa646d958cddff58232b7 Requested by Host: dkbb-login-kho999wz.fuettertdasnetz.de URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `6f8aeec4719a2894c2896b8793a3a79c76127258cccf2abe5c44b5abcc5f618d` Request headers accept-language de-DE,de;q=0.9 Referer https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 17:03:18 GMT Content-Encoding gzip Last-Modified Mon, 03 Apr 2023 17:03:18 GMT Server Apache/2.4.41 (Ubuntu) ETag W/"864b6-5f87189140ad5-gzip" Vary Accept-Encoding Transfer-Encoding chunked Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	dkb-global51c7.js Show response dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/	563 KB 142 KB	129ms 66ms	Script application/javascript	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/dkb-global51c7.js?etag=75b12549055b6d8b65c8440e2545ca66fe9c1bd8 Requested by Host: dkbb-login-kho999wz.fuettertdasnetz.de URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `9665ab6f4c4c674d523766bb87ca1c1c3048086cd811d7d4b94e52261fb01db6` Request headers accept-language de-DE,de;q=0.9 Referer https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 17:03:18 GMT Content-Encoding gzip Last-Modified Mon, 03 Apr 2023 17:03:18 GMT Server Apache/2.4.41 (Ubuntu) ETag W/"8ccd0-5f87189140ad5-gzip" Vary Accept-Encoding Transfer-Encoding chunked Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100
GET H/1.1	200 OK	dkb-global-print51f2.css dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/	221 KB 34 KB	38ms 37ms	Stylesheet text/css	80.94.95.113 SS-NET
General Check archive.org Show headers Download Go to Full URL https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/wro/dkb-global-print51f2.css?etag=95bfb8756f8f0744e469dac6160972513631d43f Requested by Host: dkbb-login-kho999wz.fuettertdasnetz.de URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 80.94.95.113 , Romania, ASN204428 (SS-NET, BG), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash `79cb5886c44f9ea2bee76bd253c67e7df5cae05c3ae3055c66d23d9c1367c130` Request headers accept-language de-DE,de;q=0.9 Referer https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 17:03:18 GMT Content-Encoding gzip Last-Modified Mon, 03 Apr 2023 17:03:18 GMT Server Apache/2.4.41 (Ubuntu) ETag W/"37460-5f87189141a75-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 34968
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	709 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `49b505ce5e0b406992c9843c684e1281ed94f63f8fc48e4afdbe43d5e8962374` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	475 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `24483b4771b2128af4110c159a9dcb59d15557460f8ecbf0bd0805f0fad5816e` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	208 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	846 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	686 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	944 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	856 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d75a13cddae198bbb040efae849b4daa89b3059e03d928714b074c37a4a8ecf7` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	669 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	864 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	911 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `aaaab8bd6ca3c54bdce3326acf1e6ad3de078008ed8e45984f9f9cac1e7c68b8` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DKB (Banking)

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
dkbb-login-kho999wz.fuettertdasnetz.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5rg8qbv30b3hntn6mur7b6fj6v
dkbb-login-kho999wz.fuettertdasnetz.de/	1969-12-31 23:59:59	Name: javascript Value: enabled
dkbb-login-kho999wz.fuettertdasnetz.de/	1969-12-31 23:59:59	Name: BRSINFO_env Value: windowSize%3D1600x1200
dkbb-login-kho999wz.fuettertdasnetz.de/	1969-12-31 23:59:59	Name: BRSINFO_browserPlugins Value: internal-pdf-viewer%3Bmhjfbmdgcfjbbpaeojofohoefgiehjai%3Binternal-nacl-plugin%3B
dkbb-login-kho999wz.fuettertdasnetz.de/	1969-12-31 23:59:59	Name: BRSINFO_screen Value: width%3D1600%3Bheight%3D1200%3BcolorDepth%3D24

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://dkbb-login-kho999wz.fuettertdasnetz.de/access/eportal/cea9f56c7aedf47de126d0a858cf3bc1/ruxitagentjs_ICA2NVfhjqrux_10255221104040649.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dkbb-login-kho999wz.fuettertdasnetz.de
80.94.95.113
0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9
24483b4771b2128af4110c159a9dcb59d15557460f8ecbf0bd0805f0fad5816e
3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0
44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af
49b505ce5e0b406992c9843c684e1281ed94f63f8fc48e4afdbe43d5e8962374
5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
6f8aeec4719a2894c2896b8793a3a79c76127258cccf2abe5c44b5abcc5f618d
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
79cb5886c44f9ea2bee76bd253c67e7df5cae05c3ae3055c66d23d9c1367c130
843ee8b9041e28bc9852791e3860dceef0473fe3c598561c2a779039a9c46314
8dfe4af08e7abe58787bf375277639ec3ff64797695739eb0d95d703021d1362
9665ab6f4c4c674d523766bb87ca1c1c3048086cd811d7d4b94e52261fb01db6
a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb
aaaab8bd6ca3c54bdce3326acf1e6ad3de078008ed8e45984f9f9cac1e7c68b8
d75a13cddae198bbb040efae849b4daa89b3059e03d928714b074c37a4a8ecf7
f3dc30601426f91d05074617d2e242b7662e707faf30833effe76e5a1037f262
fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd

dkbb-login-kho999wz.fuettertdasnetz.de Open in urlscan Pro 80.94.95.113 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

483 kBTransfer

2233 kBSize

5 Cookies

33 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

135 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

dkbb-login-kho999wz.fuettertdasnetz.de Open in urlscan Pro
80.94.95.113 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

483 kB
Transfer

2233 kB
Size

5
Cookies

7 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!