umstellung-service-lbb.xyz Open in urlscan Pro
2606:4700:30::681c:1816 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://hzzdsem.com/hello/
Effective URL:
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do...
Submission Tags: @ipnigh
Submission: On October 09 via api (October 9th 2019, 11:03:33 pm UTC) from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2606:4700:30::681c:1816, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is umstellung-service-lbb.xyz.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 9th 2019. Valid for: a year.

This is the only time umstellung-service-lbb.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Landesbank Berlin (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	154.88.157.163 154.88.157.163	54600 (PEGTECHINC) (PEGTECHINC - PEG TECH INC)
1	2606:4700:30:... 2606:4700:30::6818:6ad8	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 12	2606:4700:30:... 2606:4700:30::681c:1816	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	89.106.184.28 89.106.184.28	5630 (WORLDLINE...) (WORLDLINE-GERMANY Atos Worldline SAS)
13	3

1 154.88.157.163 (United States) 1 redirects

ASN54600 (PEGTECHINC - PEG TECH INC, US)

hzzdsem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::6818:6ad8 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

shorty-noono.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:30::681c:1816 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

umstellung-service-lbb.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.106.184.28 (Aachen, Germany)

ASN5630 (WORLDLINE-GERMANY Atos Worldline SAS, DE)

kreditkarten-banking.lbb.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	umstellung-service-lbb.xyz 1 redirects umstellung-service-lbb.xyz	29 KB
1	lbb.de kreditkarten-banking.lbb.de	11 KB
1	shorty-noono.live shorty-noono.live	392 B
1	hzzdsem.com 1 redirects hzzdsem.com	234 B
13	4

	Domain	Requested by
12	umstellung-service-lbb.xyz	1 redirects shorty-noono.live umstellung-service-lbb.xyz
1	kreditkarten-banking.lbb.de	umstellung-service-lbb.xyz
1	shorty-noono.live
1	hzzdsem.com	1 redirects
13	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-10-02` - `2020-10-01`	a year	crt.sh
kreditkarten-banking.lbb.de DigiCert SHA2 Extended Validation Server CA	`2018-02-05` - `2020-02-05`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Frame ID: 034AD6B418511C9B0ED408491AB11862
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://hzzdsem.com/hello/ HTTP 302
https://shorty-noono.live/U8N3U Page URL
https://umstellung-service-lbb.xyz/ HTTP 302
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?ra... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

39 kB
Transfer

49 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://hzzdsem.com/hello/ HTTP 302
https://shorty-noono.live/U8N3U Page URL
https://umstellung-service-lbb.xyz/ HTTP 302
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://hzzdsem.com/hello/ HTTP 302
https://shorty-noono.live/U8N3U

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	U8N3U Show response shorty-noono.live/ Redirect Chain http://hzzdsem.com/hello/ https://shorty-noono.live/U8N3U	83 B 392 B	319ms 143ms	Document text/html	2606:4700:30::6818:6ad8 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://shorty-noono.live/U8N3U Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::6818:6ad8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b4da1b33ab52dc699908683d31e330c293dbbe6561e2e12f47a718feb3e0f106` Request headers :method GET :authority shorty-noono.live :scheme https :path /U8N3U pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Wed, 09 Oct 2019 23:03:17 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d7adb3419048b2726fefbc87ead3e74fe1570662197; expires=Thu, 08-Oct-20 23:03:17 GMT; path=/; domain=.shorty-noono.live; HttpOnly vary Accept-Encoding cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5233fcac7f7e5a12-VIE content-encoding br Redirect headers Server nginx Date Wed, 09 Oct 2019 23:03:16 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/5.2.17p1 Location https://shorty-noono.live/U8N3U
GET H2	200	Primary Request index.php Show response umstellung-service-lbb.xyz/lbb/ Redirect Chain https://umstellung-service-lbb.xyz/ https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON	7 KB 2 KB	59ms 59ms	Document text/html	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Requested by Host: shorty-noono.live URL: https://shorty-noono.live/U8N3U Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `32d34d85dceff6d163089a8aa786eca44e342ab7c2956482a55e4e981e98875b` Request headers :method GET :authority umstellung-service-lbb.xyz :scheme https :path /lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer https://shorty-noono.live/U8N3U accept-encoding gzip, deflate, br cookie __cfduid=ddabe79d5bb5c60a3fbb65383f3f72cfc1570662197 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Referer https://shorty-noono.live/U8N3U Response headers status 200 date Wed, 09 Oct 2019 23:03:17 GMT content-type text/html; charset=UTF-8 set-cookie PHPSESSID=2598sl8hl480pcpcjc3qf6htu7; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5233fcae6caf5952-VIE content-encoding br Redirect headers status 302 date Wed, 09 Oct 2019 23:03:17 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=ddabe79d5bb5c60a3fbb65383f3f72cfc1570662197; expires=Thu, 08-Oct-20 23:03:17 GMT; path=/; domain=.umstellung-service-lbb.xyz; HttpOnly location lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5233fcaddc625952-VIE
GET H2	200	lbb.css umstellung-service-lbb.xyz/lbb/css/	8 KB 1 KB	17ms 16ms	Stylesheet text/css	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://umstellung-service-lbb.xyz/lbb/css/lbb.css Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `c8e61f018fba093a659badcd86f283bbad9f4a6532b3b8c130587159329286dc` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT content-encoding br cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag W/"1e24-586e17f3cae00-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 5233fcaedce75952-VIE expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	Titellogo1.gif umstellung-service-lbb.xyz/lbb/css/	43 B 205 B	16ms 15ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/Titellogo1.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:46 GMT server cloudflare age 5727 etag "2b-586e17f5b3280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaedce85952-VIE content-length 43 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	LBB_login_links.gif umstellung-service-lbb.xyz/lbb/css/	59 B 136 B	20ms 19ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/LBB_login_links.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `34e7d2a8a056c839bc78c85e05fb8f8a4989a94dd78697b6237ba15f749d0484` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:46 GMT server cloudflare age 5727 etag "3b-586e17f5b3280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaedcea5952-VIE content-length 59 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	metaarea.gif umstellung-service-lbb.xyz/lbb/css/	49 B 126 B	17ms 16ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/metaarea.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag "31-586e17f3cae00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaedcec5952-VIE content-length 49 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	Banklogo.gif umstellung-service-lbb.xyz/lbb/css/	43 B 102 B	17ms 16ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/Banklogo.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:46 GMT server cloudflare age 5727 etag "2b-586e17f5b3280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaedced5952-VIE content-length 43 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H/1.1	200 OK	LBB_login_rechts.gif kreditkarten-banking.lbb.de/cust_img/berliner_spk/	11 KB 11 KB	203ms 68ms	Image image/gif	89.106.184.28 WORLDLINE-GERMANY...
General Check archive.org Show headers Download Go to Show image Full URL https://kreditkarten-banking.lbb.de/cust_img/berliner_spk/LBB_login_rechts.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.106.184.28 Aachen, Germany, ASN5630 (WORLDLINE-GERMANY Atos Worldline SAS, DE), Reverse DNS Software / Resource Hash `dba31482c5758be14143eec2611b9bf10a06d7c5563a653b3ae7c75711c1f246` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 09 Oct 2019 23:03:17 GMT X-Pad avoid browser bug Last-Modified Mon, 30 Sep 2019 13:50:08 GMT ETag "2a04-593c5838f926b" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 10756
GET H2	200	navlinks.gif umstellung-service-lbb.xyz/lbb/css/	49 B 108 B	16ms 16ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/navlinks.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag "31-586e17f3cae00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaedcee5952-VIE content-length 49 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	background.gif umstellung-service-lbb.xyz/lbb/css/	24 KB 24 KB	18ms 17ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/background.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/css/lbb.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag "5f56-586e17f3cae00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaf0d025952-VIE content-length 24406 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	meta.gif umstellung-service-lbb.xyz/lbb/css/	81 B 158 B	16ms 15ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/meta.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/css/lbb.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag "51-586e17f3cae00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaf0d035952-VIE content-length 81 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	button.gif umstellung-service-lbb.xyz/lbb/css/	67 B 144 B	19ms 18ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/button.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/css/lbb.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag "43-586e17f3cae00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaf0d055952-VIE content-length 67 expires Thu, 10 Oct 2019 03:03:17 GMT
GET H2	200	link.gif umstellung-service-lbb.xyz/lbb/css/	67 B 126 B	19ms 19ms	Image image/gif	2606:4700:30::681c:1816 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://umstellung-service-lbb.xyz/lbb/css/link.gif Requested by Host: umstellung-service-lbb.xyz URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681c:1816 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186` Request headers Sec-Fetch-Mode no-cors Referer https://umstellung-service-lbb.xyz/lbb/css/lbb.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 09 Oct 2019 23:03:17 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2019 12:45:44 GMT server cloudflare age 5727 etag "43-586e17f3cae00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 5233fcaf0d065952-VIE content-length 67 expires Thu, 10 Oct 2019 03:03:17 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Landesbank Berlin (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			umstellung-service-lbb.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2598sl8hl480pcpcjc3qf6htu7
			.umstellung-service-lbb.xyz/	1970-01-19 13:03:18	Name: __cfduid Value: ddabe79d5bb5c60a3fbb65383f3f72cfc1570662197

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hzzdsem.com
kreditkarten-banking.lbb.de
shorty-noono.live
umstellung-service-lbb.xyz
154.88.157.163
2606:4700:30::6818:6ad8
2606:4700:30::681c:1816
89.106.184.28
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
32d34d85dceff6d163089a8aa786eca44e342ab7c2956482a55e4e981e98875b
34e7d2a8a056c839bc78c85e05fb8f8a4989a94dd78697b6237ba15f749d0484
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65
b4da1b33ab52dc699908683d31e330c293dbbe6561e2e12f47a718feb3e0f106
b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a
c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182
c8e61f018fba093a659badcd86f283bbad9f4a6532b3b8c130587159329286dc
dba31482c5758be14143eec2611b9bf10a06d7c5563a653b3ae7c75711c1f246
f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186

umstellung-service-lbb.xyz Open in urlscan Pro 2606:4700:30::681c:1816 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

39 kBTransfer

49 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

Indicators

umstellung-service-lbb.xyz Open in urlscan Pro
2606:4700:30::681c:1816 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

39 kB
Transfer

49 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!