web-hive.com
Open in
urlscan Pro
2606:4700:3034::ac43:805f
Malicious Activity!
Public Scan
Effective URL: https://web-hive.com/stockexchange/LBB/DE/
Submission: On November 16 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 14th 2022. Valid for: a year.
This is the only time web-hive.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Landesbank Berlin (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 148.66.136.215 148.66.136.215 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
2 | 2606:4700:303... 2606:4700:3034::ac43:805f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
13 | 5 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
darululoomislamabad.org |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 374 |
19 KB |
2 |
web-hive.com
web-hive.com |
775 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 304 |
31 KB |
1 |
google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 285 |
17 KB |
1 |
darululoomislamabad.org
1 redirects
darululoomislamabad.org |
322 B |
0 |
Failed
function sub() { [native code] }. Failed |
|
0 |
pagespeed-mod.com
Failed
www.pagespeed-mod.com Failed |
|
0 |
scriptcdn.net
Failed
3001.scriptcdn.net Failed |
|
13 | 8 |
Domain | Requested by | |
---|---|---|
2 | cdn.jsdelivr.net |
web-hive.com
|
2 | web-hive.com |
web-hive.com
|
1 | ajax.googleapis.com |
web-hive.com
|
1 | ssl.google-analytics.com |
web-hive.com
|
1 | darululoomislamabad.org | 1 redirects |
0 | mcgbeeipkmelnpldkobichboakdfaeon Failed |
web-hive.com
|
0 | www.pagespeed-mod.com Failed |
web-hive.com
|
0 | 3001.scriptcdn.net Failed |
web-hive.com
|
13 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
amazon.lbb.de |
kkb.lbb.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-02-14 - 2023-02-14 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://web-hive.com/stockexchange/LBB/DE/
Frame ID: 084E03EB475D891139EECAC7F334CF0D
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Amazon - KreditkartenbankingPage URL History Show full URLs
-
http://darululoomislamabad.org/Ref/
HTTP 301
https://web-hive.com/stockexchange/LBB/DE/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
SweetAlert2 (JavaScript Libraries) Expand
Detected patterns
- <link[^>]+?href="[^"]+sweetalert2(?:\.min)?\.css
- sweetalert2(?:\.all)?(?:\.min)?\.js
- /npm/sweetalert2@([\d.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: lbb.de/amazon-psd2
Search URL Search Domain Scan URL
Title: finden Sie hier
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://darululoomislamabad.org/Ref/
HTTP 301
https://web-hive.com/stockexchange/LBB/DE/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
web-hive.com/stockexchange/LBB/DE/ Redirect Chain
|
2 MB 755 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.min.js
cdn.jsdelivr.net/npm/sweetalert2@11/dist/ |
42 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.min.css
cdn.jsdelivr.net/npm/sweetalert2@11/dist/ |
20 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DatPayment.js
web-hive.com/stockexchange/LBB/DE/ |
99 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ga.js
ssl.google-analytics.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
1
3001.scriptcdn.net/code/static/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
taas
www.pagespeed-mod.com/v1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
1
3001.scriptcdn.net/code/static/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
taas
www.pagespeed-mod.com/v1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Regular.ttf
mcgbeeipkmelnpldkobichboakdfaeon/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Roboto-Regular.ttf
mcgbeeipkmelnpldkobichboakdfaeon/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
382 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
98 KB 98 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
101 KB 101 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
104 KB 104 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ssl.google-analytics.com
- URL
- https://ssl.google-analytics.com/ga.js
- Domain
- 3001.scriptcdn.net
- URL
- https://3001.scriptcdn.net/code/static/1
- Domain
- www.pagespeed-mod.com
- URL
- https://www.pagespeed-mod.com/v1/taas?id=cs&ak=55c85bbdd6e4d21e7278fbbbb89a9502&si=fb4741a02e044f61940836e20590e7f6&tag=1005&rand=9c3fe3f9c76599a15d81b58ceb3bc843&ord=161233167521857
- Domain
- 3001.scriptcdn.net
- URL
- https://3001.scriptcdn.net/code/static/1
- Domain
- www.pagespeed-mod.com
- URL
- https://www.pagespeed-mod.com/v1/taas?id=cs&ak=55c85bbdd6e4d21e7278fbbbb89a9502&si=fb4741a02e044f61940836e20590e7f6&tag=1005&rand=9c3fe3f9c76599a15d81b58ceb3bc843&ord=6939456633060839
- Domain
- mcgbeeipkmelnpldkobichboakdfaeon
- URL
- chrome-extension://mcgbeeipkmelnpldkobichboakdfaeon/css/Roboto-Regular.ttf
- Domain
- mcgbeeipkmelnpldkobichboakdfaeon
- URL
- chrome-extension://mcgbeeipkmelnpldkobichboakdfaeon/css/Roboto-Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Landesbank Berlin (Banking)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| _gat object| _gaq function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| $ function| jQuery function| card function| _createClass function| _classCallCheck function| DatPayment function| Payment function| Card0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
3001.scriptcdn.net
ajax.googleapis.com
cdn.jsdelivr.net
darululoomislamabad.org
mcgbeeipkmelnpldkobichboakdfaeon
ssl.google-analytics.com
web-hive.com
www.pagespeed-mod.com
3001.scriptcdn.net
mcgbeeipkmelnpldkobichboakdfaeon
ssl.google-analytics.com
www.pagespeed-mod.com
148.66.136.215
2606:4700:3034::ac43:805f
2606:4700::6810:5614
2a00:1450:4001:808::2008
2a00:1450:4001:829::200a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1f07e7e2b1f3379e4f029914f8c5b51c3bb832306a04cb4a11fe98462da87f64
2e4f91e4755702a1ec8a9dd70f45be9913562f9332d8d35514581c21fa1abb8f
53221bb15cc0dab8786c0f19f4ef1cf64b8847a06e0e37ca93f11f3eb95dcd99
8ab2ce0edf27ed41c919a87a15ff3b3e3956e2107d35b9ebfcd95cf6c997bfda
8d001762907d743767f1af5c3398fd97d1be7aed3cb7c819a500156c49524484
a94aaf53d42548969faf5dacf2d8fb3e89cc53fcc0c2207b478fd0dc5f8c4b5a
b166631d0898f5fbe179400ea31aeccf0f56a61977cea7d56b3d6464a12fa2df
ca516daaa4549ca61ea1d018a03ca9ba2723ef71162bf32da332a85938cd235c
e140c33f0541e01429cdd9a0c58ab07de93eb09eadc84688d3eb556066c3ac13
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e