meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de
Open in
urlscan Pro
185.193.89.7
Malicious Activity!
Public Scan
Submission Tags: @phishunt_io
Submission: On July 19 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on July 19th 2023. Valid for: 3 months.
This is the only time meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Santander (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 185.193.89.7 185.193.89.7 | 210950 (ERISHENNY...) (ERISHENNYA-ASN) | |
11 | 2 |
ASN210950 (ERISHENNYA-ASN, UA)
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
com.de
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de |
297 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de |
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de
|
0 | mcgbeeipkmelnpldkobichboakdfaeon Failed |
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
de-id85hfjhahghd7142hgajfb1iuaihb18fh1hg81.com.de R3 |
2023-07-19 - 2023-10-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/
Frame ID: A2C46125690A852FCC202FD3CB80CE52
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/ |
81 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
693.e2e6b5ea.css
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/css/ |
80 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
21.aa161196.css
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/css/ |
119 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.6.1.min.js
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/js/ |
114 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderHeadlineW05-Bold.ed7772dd.woff
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/fonts/ |
69 KB 70 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderMicroTextW05-Rg.23bf5fda.woff
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/fonts/ |
36 KB 37 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderMicroTextW05-Bold.025b01e5.woff
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/fonts/ |
37 KB 37 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Regular.ttf
mcgbeeipkmelnpldkobichboakdfaeon/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SantanderText-Regular.bf509714.woff
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/fonts/ |
74 KB 74 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mcgbeeipkmelnpldkobichboakdfaeon
- URL
- chrome-extension://mcgbeeipkmelnpldkobichboakdfaeon/css/Roboto-Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Santander (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/ | Name: antibot_c028af222f59d24789d743daa601753c Value: 2fe897392acaf77c970cbd492f01b262-1689770723 |
|
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de/ | Name: PHPSESSID Value: q88cirojdnim2jrtlietsuops2 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mcgbeeipkmelnpldkobichboakdfaeon
meine-santander.de-id914814zahbjbvfc81hbg81hgvcj1bja871gc.com.de
mcgbeeipkmelnpldkobichboakdfaeon
185.193.89.7
0d8f5c2ce15ea67d50cb8e91ea73010779bc9d1b1c63845bbe9ada388a3010c8
27e88a4eb8816c793a911514ea3f66d980e5fe69f47116c233a6eb59275f5ab0
4aac8a2830d9ad63f1a04cf22603eac2f289368532f4ad03d7f62d329b80707a
55d2e0e6f8c334a884e3934f83fc97916c47be945edd8caefab1d69edf2a3808
595f1e9bd48ff7d744b23f74a89c44a07965d119adbc7293cc0e321c80880e6a
75b1b58652b02390bf27ae144d39458a97948bcc54bec26c4c40ad3809326836
956d3119408c7d63f9fcf7e1331871839111242237aaf779599bfb8f456f0e2e
a52691b705a3921c956651b3555b212307e63f18b45e86ab5126f889758763b4
ac4b1973bcbb60a9618c348825fe90fa0860f1a2bd18e7f71b352dc0f298fb9f
ea38d9618fd11548e0532b6bbf3628f4f3caac2697d626e465f602a14be0dd09