urlscan.io logo urlscan.io
SecurityTrails logo

sicher-mobile-sms-sparkasse-filliale.xyz Open in urlscan Pro
2606:4700:3034::6812:3731  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://sms-sparkasse.services/?l=MTKNKK
Effective URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Submission Tags: 6881108
Submission: On December 09 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3034::6812:3731, located in United States and belongs to CLOUDFLARENET, US. The main domain is sicher-mobile-sms-sparkasse-filliale.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 8th 2020. Valid for: a year.
This is the only time sicher-mobile-sms-sparkasse-filliale.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 5.206.227.233 49349 (DOTSI)
1 1 91.92.109.136 34224 (NETERRA-AS)
2 12 2606:4700:303... 13335 (CLOUDFLAR...)
3 104.27.179.92 13335 (CLOUDFLAR...)
13 2
Domain Requested by
12 sicher-mobile-sms-sparkasse-filliale.xyz 2 redirects sicher-mobile-sms-sparkasse-filliale.xyz
3 log.hitsteps.net sicher-mobile-sms-sparkasse-filliale.xyz
log.hitsteps.net
1 weite82738273.xyz 1 redirects
1 sms-sparkasse.services 1 redirects
13 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-12-08 -
2021-12-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Frame ID: F09CCC6FAB86AF867030BF7273AFB640
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://sms-sparkasse.services/?l=MTKNKK HTTP 302
    http://weite82738273.xyz/ HTTP 302
    http://sicher-mobile-sms-sparkasse-filliale.xyz/ HTTP 301
    https://sicher-mobile-sms-sparkasse-filliale.xyz/ HTTP 302
    https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

278 kB
Transfer

628 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://sms-sparkasse.services/?l=MTKNKK HTTP 302
    http://weite82738273.xyz/ HTTP 302
    http://sicher-mobile-sms-sparkasse-filliale.xyz/ HTTP 301
    https://sicher-mobile-sms-sparkasse-filliale.xyz/ HTTP 302
    https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
sicher-mobile-sms-sparkasse-filliale.xyz/
Redirect Chain
  • http://sms-sparkasse.services/?l=MTKNKK
  • http://weite82738273.xyz/
  • http://sicher-mobile-sms-sparkasse-filliale.xyz/
  • https://sicher-mobile-sms-sparkasse-filliale.xyz/
  • https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac495ef93e7725877175eb5c4e174cc8d73f4d5d2c9beeb1005c7e5a1ba050ca

Request headers

:method
GET
:authority
sicher-mobile-sms-sparkasse-filliale.xyz
:scheme
https
:path
/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d329825721c0b957313d83fdf840e994a1607502668; PHPSESSID=t44tos6ijrfmv80umlqneka7m4
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 08:31:08 GMT
content-type
text/html; charset=UTF-8
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
06e83939f000009742871dc000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XM83%2FUb8l1eW5AAZ7Hbzmvi%2BLsLrvx1A%2BHGh6SSgPujRgaPW1hK2iQ8jBR8LJLkXzVUGC3NH8VwDT2IUSe99CeM78HhRztGwXeAyAKczenF9KKpucQJOQfI600yO26b5xD4%2FIogpJLpFbEZQZtnsZRMy8Wq1"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5fed5e3cbfd89742-FRA
content-encoding
br

Redirect headers

date
Wed, 09 Dec 2020 08:31:08 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d329825721c0b957313d83fdf840e994a1607502668; expires=Fri, 08-Jan-21 08:31:08 GMT; path=/; domain=.sicher-mobile-sms-sparkasse-filliale.xyz; HttpOnly; SameSite=Lax PHPSESSID=t44tos6ijrfmv80umlqneka7m4; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
location
?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
cf-cache-status
DYNAMIC
cf-request-id
06e83939760000974252244000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HFAfmZqYW7zwOQzofuELc6wl%2BtmVWaeJP8PEwp5w79iL2OpTpZLKTnxBsbraON8pS2i36ZQJFclfWK2L94cXqxmJPSHFzwNU7%2B3W07hHlXegImdPkoqwaCCdits%2B2fpk8EwZXH%2BDz2Is%2Fok%2BuP5qbg80DbUx"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5fed5e3bef929742-FRA
Nb2c44603f5b95f
sicher-mobile-sms-sparkasse-filliale.xyz/ 		277 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4df974afa2c58c2ae285f7db823271bf5fa3a62096f22cc9da7abeb6daa4f6ff

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 09 Dec 2020 08:31:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3%2Bq2RJx0iY00qQjOZ1gQ3QaMiKeY0q0XaQD%2BX%2FnGFFhFf8XFqsIzALmOv8bz4gR5IEwAyUYOGVNu81r9CF3ypdew5ptO2jwxIRJMvEciHXxvn2o4AA1sCYmjl4%2F6dkSPeF%2BLmyL7qULNpQV%2B8fuHLkYAjcTX"}],"group":"cf-nel","max_age":604800}
content-type
text/css;charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
5fed5e3ff9179742-FRA
cf-request-id
06e8393bfa000097425fafa000000001
expires
Thu, 19 Nov 1981 08:52:00 GMT
N5a598e9911fe22
sicher-mobile-sms-sparkasse-filliale.xyz/ 		94 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/N5a598e9911fe22
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
cache
date
Wed, 09 Dec 2020 08:31:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dARb4flg9WXcB3wqAGeGsYac5rJKOAKP%2FbQyc%2FyuX%2BeLsUHaxfiQR9x%2FBVwwSwqx2kgMENfXf9zrJ9IUcEwTVNogTJcGziNOZx2G07Au7P%2BITaZNzlpd9u4Ayz0R%2BgeRJgnfu0PX%2BAiU%2F5wzvOQUms1QgEFD"}],"group":"cf-nel","max_age":604800}
content-type
text/plain;charset=UTF-8
cache-control
max-age=60
cf-ray
5fed5e3ff9189742-FRA
cf-request-id
06e8393bfb00009742660f6000000001
expires
Wed, 09 Dec 2020 08:32:08 GMT
N3f53b43b4a7414
sicher-mobile-sms-sparkasse-filliale.xyz/ 		2 KB
966 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/N3f53b43b4a7414
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
191a7d4285e73af3f7f14eaf68158cd94e1bb1819d976d8f8236294ff48968f7

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 09 Dec 2020 08:31:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=u4tDdQXCWmQmHnDI1NpBFW37zwPpotPVa8czGHbrqJsRuloWlSG4OQkcki5Yw%2BiOZbQVxB22xjsDjsb%2F1k7%2BF2znljEUmpwyGzPCqc%2F9mOEzIh3eau6AEcFQVt8OvYSWUJ1PtqKaeH%2BSgLFkXoC6Jx%2FBUvUI"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
5fed5e3ff9199742-FRA
cf-request-id
06e8393bfc00009742871eb000000001
expires
Thu, 19 Nov 1981 08:52:00 GMT
Nf7f0858cb11c76
sicher-mobile-sms-sparkasse-filliale.xyz/ 		16 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/Nf7f0858cb11c76
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74bcd86bc937c41e4045ef2a14f6619ffc828ceeca96e7c1946330c34abba648

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
cache
date
Wed, 09 Dec 2020 08:31:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Sap7IhfPV6omF3ebOg77MzezItXQE3aUO8eVP%2ByM6H%2BLW05HAaLsxLFKFzgTjoj%2BmATXmdYZfz7eygpTUKbA%2Fc%2BaIcSS3fmJQnrS0sclepcScNc7sipW%2Boc0CbAPkJdgMmnRKZIThCqJdXL1yzd6TYBKFciO"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=60
cf-ray
5fed5e40d9849742-FRA
cf-request-id
06e8393c8c000097427e93a000000001
expires
Wed, 09 Dec 2020 08:32:09 GMT
N6003cba2882ac8
sicher-mobile-sms-sparkasse-filliale.xyz/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/N6003cba2882ac8
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6f6eb10a4472f02adf0f74f0805afb04a0bd0f4644a1eeff94d9b36d2ffeaf6

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
cache
date
Wed, 09 Dec 2020 08:31:08 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qs%2FQbQUgHErqNMw57qIC8asjApL1PdILSx8SAF%2FMeCRaU5M1BDhsk98mM94%2BEUE59D%2B9wOP9pqUVexvY8W5TEeE0%2BiX00wzO4h0idf5EtHwgoM4PfMCF1NboeAs%2FW%2FUfQ%2Bui94GrUgEECKMB4XSOXiVyVyfr"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=60
cf-ray
5fed5e40e98b9742-FRA
content-length
6820
cf-request-id
06e8393c930000974263931000000001
expires
Wed, 09 Dec 2020 08:32:08 GMT
Nf7f4cc7c542048
sicher-mobile-sms-sparkasse-filliale.xyz/ 		98 KB
98 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/Nf7f4cc7c542048
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db39a1ce3b04ff95b2ac4de18a120c586a83d74b5bcaae232a34767a5ab0d658

Request headers

Origin
https://sicher-mobile-sms-sparkasse-filliale.xyz
Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
cache
date
Wed, 09 Dec 2020 08:31:09 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hSfctwTnpOgKxlDj6vW%2BjxpMHNIjv44erZeyxWgCNAHeb1zRdNJoC9Xyh74Cceg7NqLt8TOBLhgkEIuvT5u4ti%2BTTQEMj9bw6VZdDWC6YfYivG%2Bp1s3YkPQXpfsDYGGZ1%2BqV3%2BRjaG8cjydxu22Eb1pybvkO"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=60
cf-ray
5fed5e4109a59742-FRA
cf-request-id
06e8393caa0000974292338000000001
expires
Wed, 09 Dec 2020 08:32:08 GMT
Ne471370c95c242
sicher-mobile-sms-sparkasse-filliale.xyz/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/Ne471370c95c242
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

Request headers

Origin
https://sicher-mobile-sms-sparkasse-filliale.xyz
Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
cache
date
Wed, 09 Dec 2020 08:31:09 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HbCECsk%2FeMkhERr3coMS5Ctgs5BVgEjR3WLpYFOtYCaDvdmk1yYgeARKofJS%2FMXJr2Iuco3%2FLtS5RKFjiBsdZ6npDXYTf%2B81h0MLSYYm2E466PhLLB5YDMx60kd0d3l9%2BmOu2aLneLRQlNKSithYS7ht%2F6fj"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=60
cf-ray
5fed5e4109a69742-FRA
cf-request-id
06e8393caa000097426c124000000001
expires
Wed, 09 Dec 2020 08:32:09 GMT
N9a2387fb23c4bb
sicher-mobile-sms-sparkasse-filliale.xyz/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/N9a2387fb23c4bb
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2

Request headers

Origin
https://sicher-mobile-sms-sparkasse-filliale.xyz
Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/Nb2c44603f5b95f
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
cache
date
Wed, 09 Dec 2020 08:31:09 GMT
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tstZMLNqNi7TDo3SuZhuOod5h8GD0ERC2ViS42Tiwofo2fKWTs0DBJMGebPM%2Bxn%2FsT%2FzoYRXXdT%2BlAsNG1D6OEqpV9jDE2aUv%2BLNbpXlRKTz7POu4Yj3x4t3ebXUaFjkg3ee7gofoBLuB1MOPI9nBKC3bP60"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=60
cf-ray
5fed5e4109a79742-FRA
cf-request-id
06e8393cab00009742681e0000000001
expires
Wed, 09 Dec 2020 08:32:08 GMT
track.php
log.hitsteps.net/ 		40 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://log.hitsteps.net/track.php?code=2fddb3d00b67c2741645e8245fcb3972
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.179.92 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.11
Resource Hash
ca331751b6414e137f6216de296626803ea03f8a78558c823f18daad39a1df88

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 08:31:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
x-powered-by
PHP/7.4.11
p3p
CP="CAO PSA OUR"
cf-request-id
06e8393d1e000008573d102000000001
pragma
no-cache
last-modified
Wed, 09 Dec 2020 08:31:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2Q97vfsDyKVNJUmP6w21NGMKqEie4jeUZcnlaHxSkSGCKVulATP3ouFYClO1CHqf2gbDszvrHTcah02Pw8KQElAHm%2BmcN7fe%2Bv%2FssUaayezl"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=3600, s-max-age=84600
cf-ray
5fed5e41c9150857-CDG
expires
Tue, 03 Jul 2001 06:00:00 GMT
/
sicher-mobile-sms-sparkasse-filliale.xyz/ 		8 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/N5a598e9911fe22
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6812:3731 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac495ef93e7725877175eb5c4e174cc8d73f4d5d2c9beeb1005c7e5a1ba050ca

Request headers

Accept
*/*
Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 09 Dec 2020 08:31:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MtWZqJi%2BfoT66wBOEKx%2FZS7vD8zimYe9EeYKEeq6d%2BSyeu9ALkREiJAEUe%2FsiLguWVorwHPYq2DFcFet64%2BG4GCJAO7ACWH0MyNIfEIE0eFN6KT6Bi1VUGywHgkXwAZi6%2BpxJclH2VNkeB7CjA%2FZAJzH0rub"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
5fed5e4179e99742-FRA
cf-request-id
06e8393ce9000097425fb06000000001
expires
Thu, 19 Nov 1981 08:52:00 GMT
gather.php
log.hitsteps.net/ 		16 B
16 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://log.hitsteps.net/gather.php?sid=85389&ui=10hbgaw88b7n&aid=72816&u=https%3A//sicher-mobile-sms-sparkasse-filliale.xyz/%3Fhome%3DQgXylLe5x6RrZz3%26id%3D0twsod6PYbe8Bir%26kunde%3Dz8Pog3jfUl1M4yn&et=1&ti=Online%20Legimitation&touchpoints=0&sh=1200&sw=1600&sc=24&wsh=1200&wsw=1600&p=&l=en-US&c=Linux%20x86_64&t=60&ja=1&fv=&MySearch=&uniqueid=&integrity=&ipname=&gdpr=2&Tag=&label=&iTag=&iPage=&utm_source=&src=&jv=0&ca=1&uidn=&hitc=&rev=&goal=&timing=1248&dm=sicher-mobile-sms-sparkasse-filliale.xyz&v=0.7642130258107476
Requested by
Host: sicher-mobile-sms-sparkasse-filliale.xyz
URL: https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.179.92 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.11
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 08:31:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
x-powered-by
PHP/7.4.11
p3p
CP="CAO PSA OUR"
cf-request-id
06e8393e3e0000085742215000000001
pragma
no-cache
last-modified
Wed, 09 Dec 2020 08:31:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NqV%2FSxAQ8AYs5V5O9awULLYWMC0nqpc6p%2B78qu%2BEIkCP9urutQt87hpQlHhx2j%2BlS675rNps3jNi4opIT%2BCy6hSK%2FRvDxayBrwSaUyk9Pfab"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-ray
5fed5e439cf30857-CDG
expires
Tue, 03 Jul 2001 06:00:00 GMT
png.php
log.hitsteps.net/ 		19 B
447 B 		Script
General
Check archive.org
Download Go to
Full URL
https://log.hitsteps.net/png.php?idle=0&aid=72816&sid=85389&temp_uid=10hbgaw88b7n&lang=auto&bat=100//Adapter//00%3A00//---&aplg=not%20found
Requested by
Host: log.hitsteps.net
URL: https://log.hitsteps.net/track.php?code=2fddb3d00b67c2741645e8245fcb3972
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.27.179.92 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.11
Resource Hash
35bf1f63fb0039a6f6b3e6890ded2bf9df49f8088d91bc986018f7bbc9728619

Request headers

Referer
https://sicher-mobile-sms-sparkasse-filliale.xyz/?home=QgXylLe5x6RrZz3&id=0twsod6PYbe8Bir&kunde=z8Pog3jfUl1M4yn
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 08:31:10 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
x-powered-by
PHP/7.4.11
p3p
CP="CAO PSA OUR"
cf-request-id
06e839422a000008573d184000000001
pragma
no-cache
last-modified
Wed, 09 Dec 2020 08:31:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZdjLgXc0OQnK7PWAYiuqAUFzw1EW66ktvzoYuGTFB4BJiJGHXRIkuAW%2BEhXf5cplaB%2FHlABFmPwoGiff7ZrbSXU416OBxfLaFeX1MN01iRrj"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-ray
5fed5e49dc850857-CDG
expires
Tue, 03 Jul 2001 06:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

100 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| selectElement function| _hs_getqs function| _hs_setData function| _hs_getData string| ipname_temp string| _hs_uniqueid_temp number| _hs_gdpr_diag function| _hs_checkGDPR string| _hs_bat object| _hs_sysbat string| _hs_adplug string| _hs_a_uid number| _hs_navigator_touchpoints function| _hs_readAdplugin function| _hs_readBattery function| _HSTracker number| _HS_jquery_injected number| HSTracked number| ChatDiv undefined| _HS_body undefined| _HS_html undefined| _HS_dhh undefined| hstc undefined| hstcs undefined| htssc function| _hs_getParmFromHash function| getScript object| hsutube number| hsytindex object| hsutbarr object| hsplayerArray object| hitsteps number| hs_idleTime number| hs_idle number| hs_idles number| hs_timed function| _hsni_addListener function| _hsni_get_href function| _hsni_get_parent function| _hsni_get_target function| _hsni_trackAlinks function| _hsni_noIdle function| _hsni_Idle function| _hsni_mnoIdle function| hs_CheckInactivity function| onYouTubePlayerReady function| onYouTubeIframeAPIReady function| _hs_elementor_video_overlay function| _hs_hash_changed number| aid number| sid string| _hs_api_code_public string| hs_lang number| hs_enable_form number| _hs_noyoutubeapi number| _hs_heatmap_allowed number| _hs_pre_compliance string| _hs_gdpr_compliance_txt string| _hs_gdpr_btn_yes string| _hs_gdpr_btn_no function| _hs_a_giveMeRandom function| _hs_a_readCookie function| _hs_a_writeCookie function| _hs_a_setVal function| _hs_a_getVal function| _hs_bt_toTime object| prm number| nochat number| _hs_youtubeapiloaded number| hs_pingcount number| _hs_gdpr object| img string| hs_rev string| hs_goal string| mysearch string| MySearch string| tag string| Tag string| label string| IPname string| ipname string| _hs_uniqueid string| _hs_integrity string| _hs_last_full_url string| uaddress string| utitle string| uref string| new_url object| battery

3 Cookies

Domain/Path Name / Value
sicher-mobile-sms-sparkasse-filliale.xyz/ Name: _HS_temp_id
Value: 10hbgaw88b7n
sicher-mobile-sms-sparkasse-filliale.xyz/ Name: PHPSESSID
Value: t44tos6ijrfmv80umlqneka7m4
.sicher-mobile-sms-sparkasse-filliale.xyz/ Name: __cfduid
Value: d329825721c0b957313d83fdf840e994a1607502668