![](/screenshots/333041b3-b243-4179-94cf-11fa56df075d.png)
kunde.pp-login.com.de
Open in
urlscan Pro
94.156.6.71
Malicious Activity!
Public Scan
Effective URL: https://kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i51...
Submission: On September 17 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on September 16th 2023. Valid for: 3 months.
This is the only time kunde.pp-login.com.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
20 | 94.156.6.71 94.156.6.71 | 211252 (AS_DELIS) (AS_DELIS) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:820::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 66.6.22.216 66.6.22.216 | 48851 (RADWARE) (RADWARE) | |
2 | 2607:f8b0:402... 2607:f8b0:4020:804::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
com.de
kunde.pp-login.com.de |
236 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
1 |
bundesfinanzministerium.de
www.bundesfinanzministerium.de — Cisco Umbrella Rank: 684151 |
8 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 56 |
1 KB |
24 | 4 |
Domain | Requested by | |
---|---|---|
20 | kunde.pp-login.com.de |
kunde.pp-login.com.de
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | www.bundesfinanzministerium.de |
kunde.pp-login.com.de
|
1 | fonts.googleapis.com |
kunde.pp-login.com.de
|
24 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
psd2-erstattung.com.de R3 |
2023-09-16 - 2023-12-15 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-08-14 - 2023-11-06 |
3 months | crt.sh |
*.bundesfinanzministerium.de Telekom Security ServerID OV Class 2 CA |
2023-01-09 - 2024-01-13 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-08-14 - 2023-11-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/69i57j0i546.12353j0j1&sourceid=chrome&ie=UTF-8/index4.php
Frame ID: ED3CAE4A6E5D3B8ED9EDC1DAE754DB28
Requests: 24 HTTP requests in this frame
Screenshot
![](/screenshots/333041b3-b243-4179-94cf-11fa56df075d.png)
Page Title
Federal Ministry of FinancePage URL History Show full URLs
- https://kunde.pp-login.com.de/?home=FAbKTqNnMcP2uds&id=f2PWxrFKDYmUlMp&privatkunden=VMuKjFcCQE6R9pr Page URL
- https://kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://kunde.pp-login.com.de/?home=FAbKTqNnMcP2uds&id=f2PWxrFKDYmUlMp&privatkunden=VMuKjFcCQE6R9pr Page URL
- https://kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/69i57j0i546.12353j0j1&sourceid=chrome&ie=UTF-8/index4.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
kunde.pp-login.com.de/ |
336 B 534 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index4.php
kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/69i57j0i546.12353j0j1&sourceid=chrome&ie=UTF-8/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mmenu.css
kunde.pp-login.com.de/public/ |
47 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
kunde.pp-login.com.de/public/ |
23 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master.css
kunde.pp-login.com.de/public/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_en.svg
www.bundesfinanzministerium.de/SiteGlobals/StyleBundles/Bilder/Farbschema/ |
18 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sparkasse.jpg
kunde.pp-login.com.de/public/logo/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
deutsche.png
kunde.pp-login.com.de/public/logo/ |
33 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
volksbank.png
kunde.pp-login.com.de/public/logo/ |
58 KB 58 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dkb.jpg
kunde.pp-login.com.de/public/logo/ |
12 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
santander.png
kunde.pp-login.com.de/public/logo/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
consors.png
kunde.pp-login.com.de/public/logo/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-be.png
kunde.pp-login.com.de/public/logo/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
postbank.png
kunde.pp-login.com.de/public/logo/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
commerz.png
kunde.pp-login.com.de/public/logo/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.3.min.js
kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mmenu.polyfills.js
kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mmenu.js
kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match-height.js
kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master.js
kunde.pp-login.com.de/aqs=edge..69i57l2j69i59j69i60j69i61l2.847j0j9&sourceid=chrome&ie=UTF-8/edge.0.69i59l3j69i57j0i512l2j69i60l3.9662j0j1/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
print.css
kunde.pp-login.com.de/public/ |
799 B 658 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kunde.pp-login.com.de/ | Name: PHPSESSID Value: as7g8892or974ni36fdhmd4sd3 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
kunde.pp-login.com.de
www.bundesfinanzministerium.de
2607:f8b0:4006:820::200a
2607:f8b0:4020:804::2003
66.6.22.216
94.156.6.71
222d75918bb518d46a4d283da7de243b4409d597a8c6856070a07e96b600e6d7
28f03036f256ba8bfb540e7b9049453a3cb9ab8c76233e83bc369bdddaec85ee
37e03393e6b3472646cfee36f921a13a7ca6375a58eb2a330e4672c439588e91
46398f6374e7f7afd4384087d40fc17b640714a90fb7267aeb8b4ebb60cc7df1
4d3233a7684fbfb6814197468a68124f9a4e2b5db7a366f7fa71940c3ed8b50d
59b9002c99f712d5e4a7c5b757abdf011c21cb7731f02475fe6dd64d72897e07
66467ffc74bdfc39c0d66f037cf079dc6f6ff2a865b195b2f6904277022eacc1
6650039d90c7927c18ccb1e0befecc9cb8ff176b1ef71736d13777a164f19188
801ee256bd84ee5edeecd2ea3a73b27654306cead98e64b9c6888cc66b79107b
98b0ea6538f059e1d45235b9091fe5095ed949614c6c595ad47401ea11bde1db
b789690aa89f78c2f2267ce8d13359976f93daf0c92b8faf3093360c3d2bed02
c0d9caf068176fef69f3f3efe38afd191d2dccd680cc78c65a8991022f362690
d95ffdcf010d6749281f6cd27c3a5f9c856d4b5590cee285f4b4fdbebce22b4c
e9987e3d13391eb17bd50ca1c3a7d5d5b2df2f4463260d136e3b1c0476e9ea14
eb1cc1d4946ca3ebae0a4e50cf9e21b40888817e6e2c0747911642ecef86e8b5
f2ffea1bfb0cecceb056b53ae07bb078028d3e99e201208643d6781c921cc849
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef