sparkasse.meinegerate.de Open in urlscan Pro
199.192.25.239 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sparkasse.meinegerate.de/DE/
Effective URL:
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/
Submission: On March 21 via automatic, source phishtank (March 21st 2022, 11:07:31 pm UTC) — Scanned from DE

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 199.192.25.239, located in United States and belongs to NAMECHEAP-NET, US. The main domain is sparkasse.meinegerate.de.
TLS certificate: Issued by R3 on March 21st 2022. Valid for: 3 months.

This is the only time sparkasse.meinegerate.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2 24	199.192.25.239 199.192.25.239		22612 (NAMECHEAP...) (NAMECHEAP-NET)
22	1

24 199.192.25.239 (United States) 2 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server1.educationnewshub.co.ke

sparkasse.meinegerate.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	meinegerate.de 2 redirects sparkasse.meinegerate.de	344 KB
22	1

	Domain	Requested by
24	sparkasse.meinegerate.de	2 redirects sparkasse.meinegerate.de
22	1

This site contains no links.

Subject Issuer	Validity	Valid
sparkasse.meinegerate.de R3	`2022-03-21` - `2022-06-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/
Frame ID: 82311D3654C30E3C280BD14301D44E37
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Online-Banking

Page URL History Show full URLs

https://sparkasse.meinegerate.de/DE/ Page URL
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d HTTP 301
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/ HTTP 302
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

343 kB
Transfer

791 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sparkasse.meinegerate.de/DE/ Page URL
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d HTTP 301
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/ HTTP 302
https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response sparkasse.meinegerate.de/DE/	754 B 724 B	466ms 154ms	Document text/html	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `a6f10117051e03b80b686dfa626256ce5e0b4496f657722a1133d32d80e0f208` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Mon, 21 Mar 2022 23:07:26 GMT Server Apache/2.4.18 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Content-Length 451 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request / Show response sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/ Redirect Chain https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d? https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/? https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/?	55 KB 9 KB	171ms 170ms	Document text/html	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `b4f3886a682ac98be84dfc5164ad25994b6bc51dbf68250eb74493890c28ca42` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/ Response headers Date Mon, 21 Mar 2022 23:07:28 GMT Server Apache/2.4.18 (Ubuntu) Vary Accept-Encoding Content-Encoding gzip Content-Length 9396 Keep-Alive timeout=5, max=97 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 21 Mar 2022 23:07:28 GMT Server Apache/2.4.18 (Ubuntu) location login/? Content-Length 0 Keep-Alive timeout=5, max=98 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	jquery.min.js Show response sparkasse.meinegerate.de/DE/bower_components/jquery/dist/	85 KB 30 KB	155ms 154ms	Script application/javascript	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/bower_components/jquery/dist/jquery.min.js Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:28 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:10:43 GMT Server Apache/2.4.18 (Ubuntu) ETag "15283-5daba39450843-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 30138
GET H/1.1	200 OK	ua-parser.min.js Show response sparkasse.meinegerate.de/DE/bower_components/ua-parser-js/dist/	17 KB 6 KB	456ms 151ms	Script application/javascript	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:28 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:11:19 GMT Server Apache/2.4.18 (Ubuntu) ETag "4298-5daba3b6db38d-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 6063
GET H/1.1	200 OK	font-awesome.min.css sparkasse.meinegerate.de/DE/bower_components/font-awesome/css/	30 KB 7 KB	452ms 151ms	Stylesheet text/css	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:28 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:09:58 GMT Server Apache/2.4.18 (Ubuntu) ETag "7918-5daba369ff976-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7053
GET H/1.1	200 OK	css.css sparkasse.meinegerate.de/DE/login/form/	357 B 542 B	452ms 151ms	Stylesheet text/css	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/form/css.css Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `823f9dfa3ee6b0ff35ef3a6662967325e4053898692cc803c4c9aff9cdcbc3db` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:28 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:07:55 GMT Server Apache/2.4.18 (Ubuntu) ETag "165-5daba2f47adc5-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 206
GET H/1.1	200 OK	index.css sparkasse.meinegerate.de/DE/login/	345 KB 43 KB	462ms 161ms	Stylesheet text/css	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/index.css Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `0e484d77149aa34836c6289eadf2ea5380caecb7865ac5ffc00ae7b4990147bb` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:28 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:03:32 GMT Server Apache/2.4.18 (Ubuntu) ETag "5649c-5daba1f9df1a1-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 43320
GET H/1.1	200 OK	form.js Show response sparkasse.meinegerate.de/DE/login/form/	9 KB 3 KB	152ms 151ms	Script application/javascript	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/form/form.js?v=623905302d388 Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `47c4c7b3fddbf6b4c854f09c3d434da26826a2affeca30874e1846ce275b3bc0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:07:55 GMT Server Apache/2.4.18 (Ubuntu) ETag "2535-5daba2f4a1ec4-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2801
GET H/1.1	200 OK	spk-logo-desktop.png sparkasse.meinegerate.de/DE/login/	7 KB 7 KB	150ms 150ms	Image image/png	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/spk-logo-desktop.png Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `a4f04574b20972a5b290984c214ff23af7810b73db0a640c75bf11b2a042336b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:49 GMT Server Apache/2.4.18 (Ubuntu) ETag "1bb5-5daba209754e4" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=94 Content-Length 7093
GET H/1.1	200 OK	spk-logo-mobile.png sparkasse.meinegerate.de/DE/login/	5 KB 5 KB	151ms 151ms	Image image/png	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/spk-logo-mobile.png Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `723733a7bb6f25194a40769ba4b2c4b4840d707bba89f745984fab9442f72141` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:50 GMT Server Apache/2.4.18 (Ubuntu) ETag "146c-5daba20a7a0bb" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5228
GET H/1.1	200 OK	spk-logo-druck.png sparkasse.meinegerate.de/DE/login/	6 KB 6 KB	151ms 150ms	Image image/png	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/spk-logo-druck.png Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `92a47005456ffc3265cfb02b76cfb77edf109347cd59ef3c755aec4ffd4e8e85` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:49 GMT Server Apache/2.4.18 (Ubuntu) ETag "18d5-5daba209977c2" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6357
GET H/1.1	200 OK	1528717408685.png sparkasse.meinegerate.de/DE/login/	7 KB 7 KB	151ms 151ms	Image image/png	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/1528717408685.png Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `622cdddf9135812f42c5b6396df2b08c836819bb84d0bcd9e82e779d0a4ad469` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:29 GMT Server Apache/2.4.18 (Ubuntu) ETag "1b6e-5daba1f683bbc" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7022
GET H/1.1	200 OK	1507888956944.png sparkasse.meinegerate.de/DE/login/	39 KB 40 KB	452ms 150ms	Image image/png	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/1507888956944.png Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:28 GMT Server Apache/2.4.18 (Ubuntu) ETag "9d92-5daba1f578284" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 40338
GET H/1.1	200 OK	1507889499605.jpg sparkasse.meinegerate.de/DE/login/	6 KB 6 KB	159ms 159ms	Image image/jpeg	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/1507889499605.jpg Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:29 GMT Server Apache/2.4.18 (Ubuntu) ETag "1658-5daba1f65cabd" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 5720
GET H/1.1	200 OK	tdg sparkasse.meinegerate.de/DE/login/	45 B 302 B	158ms 158ms	Image image/gif	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://sparkasse.meinegerate.de/DE/login/tdg Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:50 GMT Server Apache/2.4.18 (Ubuntu) ETag "2d-5daba20a86bdb" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 45
GET H/1.1	200 OK	token.js Show response sparkasse.meinegerate.de/DE/login/token/	11 KB 2 KB	313ms 160ms	Script application/javascript	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/token/token.js?v=623905302d3d7 Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `3785a8704d55ab90c4b042a72683262af807e6ba1e353f77e06768aeaa4baa65` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Content-Encoding gzip Last-Modified Mon, 21 Mar 2022 13:08:00 GMT Server Apache/2.4.18 (Ubuntu) ETag "2a77-5daba2f8f6501-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1795
GET H/1.1	200 OK	sparkasse_web_rg.woff sparkasse.meinegerate.de/DE/login/	39 KB 39 KB	301ms 152ms	Font application/font-woff	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/sparkasse_web_rg.woff Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/login/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2` Request headers Referer https://sparkasse.meinegerate.de/DE/login/index.css Origin https://sparkasse.meinegerate.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:48 GMT Server Apache/2.4.18 (Ubuntu) ETag "9a44-5daba2088ed6b" Content-Type application/font-woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=93 Content-Length 39492
GET H/1.1	200 OK	pictos-if.woff sparkasse.meinegerate.de/DE/login/	64 KB 64 KB	301ms 152ms	Font application/font-woff	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/pictos-if.woff Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/login/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `d6fff4dce0ed66b0ef96ec5165e4b5fa7d2d193df2537040630dd19606b7b664` Request headers Referer https://sparkasse.meinegerate.de/DE/login/index.css Origin https://sparkasse.meinegerate.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:36 GMT Server Apache/2.4.18 (Ubuntu) ETag "ff6c-5daba1fd38846" Content-Type application/font-woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 65388
GET H/1.1	200 OK	sparkasse_web_bd.woff sparkasse.meinegerate.de/DE/login/	39 KB 39 KB	299ms 150ms	Font application/font-woff	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/sparkasse_web_bd.woff Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/login/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638` Request headers Referer https://sparkasse.meinegerate.de/DE/login/index.css Origin https://sparkasse.meinegerate.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:43 GMT Server Apache/2.4.18 (Ubuntu) ETag "9b38-5daba203d0011" Content-Type application/font-woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 39736
GET H/1.1	200 OK	sparkasse_web_lt.woff sparkasse.meinegerate.de/DE/login/	27 KB 27 KB	300ms 151ms	Font application/font-woff	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/DE/login/sparkasse_web_lt.woff Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/login/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `133ad01e7b25970c5cbcce3d8ffb7f23eef311c5950d9fcf27463c49e9ae3f02` Request headers Referer https://sparkasse.meinegerate.de/DE/login/index.css Origin https://sparkasse.meinegerate.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Last-Modified Mon, 21 Mar 2022 13:03:46 GMT Server Apache/2.4.18 (Ubuntu) ETag "6aec-5daba20718d16" Content-Type application/font-woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 27372
GET H/1.1	200 OK	token.php Show response sparkasse.meinegerate.de/theredbike/gates/	57 B 258 B	300ms 160ms	XHR application/javascript	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/theredbike/gates/token.php?pl=token&link=sparkase.de&bid=fb2dbb90647f60131d1cc746048ad40d&callback=jQuery32107699047088511055_1647904048605&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1647904048606 Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `f4d9b5ddd56c305cb7c508b5b5a21647a36defd68d21e7528eb43b7ca6cb1ed8` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=92 Content-Length 57 Content-Type application/javascript
GET H/1.1	200 OK	token.php Show response sparkasse.meinegerate.de/theredbike/gates/	57 B 258 B	290ms 153ms	XHR application/javascript	199.192.25.239 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://sparkasse.meinegerate.de/theredbike/gates/token.php?pl=token&link=sparkase.de&bid=fb2dbb90647f60131d1cc746048ad40d&callback=jQuery32107699047088511055_1647904048607&data=%7B%22mes%22%3A%22User%20on%20Login%20page%22%7D&_=1647904048608 Requested by Host: sparkasse.meinegerate.de URL: https://sparkasse.meinegerate.de/DE/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.192.25.239 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.educationnewshub.co.ke Software Apache/2.4.18 (Ubuntu) / Resource Hash `b319b19cf69f1af0e7a6ab00a71b6573ffb1f1a98419ce99a463cb63ed068ef1` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d/login/? X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Mon, 21 Mar 2022 23:07:29 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 57 Content-Type application/javascript

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sparkasse.meinegerate.de/DE/a1b2c3/fb2dbb90647f60131d1cc746048ad40d	1969-12-31 23:59:59	Name: bid Value: fb2dbb90647f60131d1cc746048ad40d
			sparkasse.meinegerate.de/DE	1969-12-31 23:59:59	Name: real Value: OK

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sparkasse.meinegerate.de
199.192.25.239
0e484d77149aa34836c6289eadf2ea5380caecb7865ac5ffc00ae7b4990147bb
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
133ad01e7b25970c5cbcce3d8ffb7f23eef311c5950d9fcf27463c49e9ae3f02
3785a8704d55ab90c4b042a72683262af807e6ba1e353f77e06768aeaa4baa65
47c4c7b3fddbf6b4c854f09c3d434da26826a2affeca30874e1846ce275b3bc0
4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753
622cdddf9135812f42c5b6396df2b08c836819bb84d0bcd9e82e779d0a4ad469
62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4
723733a7bb6f25194a40769ba4b2c4b4840d707bba89f745984fab9442f72141
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
823f9dfa3ee6b0ff35ef3a6662967325e4053898692cc803c4c9aff9cdcbc3db
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
92a47005456ffc3265cfb02b76cfb77edf109347cd59ef3c755aec4ffd4e8e85
a4f04574b20972a5b290984c214ff23af7810b73db0a640c75bf11b2a042336b
a6f10117051e03b80b686dfa626256ce5e0b4496f657722a1133d32d80e0f208
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
b319b19cf69f1af0e7a6ab00a71b6573ffb1f1a98419ce99a463cb63ed068ef1
b4f3886a682ac98be84dfc5164ad25994b6bc51dbf68250eb74493890c28ca42
d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288
d6fff4dce0ed66b0ef96ec5165e4b5fa7d2d193df2537040630dd19606b7b664
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638
f4d9b5ddd56c305cb7c508b5b5a21647a36defd68d21e7528eb43b7ca6cb1ed8

sparkasse.meinegerate.de Open in urlscan Pro 199.192.25.239 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

343 kBTransfer

791 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

31 JavaScript Global Variables

2 Cookies

Indicators

sparkasse.meinegerate.de Open in urlscan Pro
199.192.25.239 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

343 kB
Transfer

791 kB
Size

2
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!