erste-george.meditrans.it
Open in
urlscan Pro
185.2.4.84
Malicious Activity!
Public Scan
Submission: On January 03 via api from NL — Scanned from IT
Summary
TLS certificate: Issued by R3 on January 2nd 2024. Valid for: 3 months.
This is the only time erste-george.meditrans.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 185.2.4.84 185.2.4.84 | 203461 (REGISTER_...) (REGISTER_UK-AS) | |
3 | 213.150.6.28 213.150.6.28 | 12895 (IT-AUSTRI...) (IT-AUSTRIA Vienna) | |
13 | 3 |
ASN203461 (REGISTER_UK-AS, IT)
PTR: lhcp1084.webapps.net
erste-george.meditrans.it |
ASN12895 (IT-AUSTRIA Vienna, Austria, AT)
PTR: login.sparkasse.at
login.sparkasse.at |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
meditrans.it
erste-george.meditrans.it |
477 KB |
3 |
sparkasse.at
login.sparkasse.at — Cisco Umbrella Rank: 895985 |
3 KB |
13 | 2 |
Domain | Requested by | |
---|---|---|
10 | erste-george.meditrans.it |
erste-george.meditrans.it
|
3 | login.sparkasse.at |
erste-george.meditrans.it
|
13 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sparkasse.at |
Subject Issuer | Validity | Valid | |
---|---|---|---|
erste-george.meditrans.it R3 |
2024-01-02 - 2024-04-01 |
3 months | crt.sh |
login.sparkasse.at DigiCert EV RSA CA G2 |
2023-03-16 - 2024-03-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://erste-george.meditrans.it/at/oauth/erste/
Frame ID: 050C8DBED185E502227CBFA2E20B2B19
Requests: 14 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: hier
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
erste-george.meditrans.it/at/oauth/erste/ |
107 KB 107 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lib.css
erste-george.meditrans.it/at/oauth/erste/files/ |
93 KB 93 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gWqvRrszL2yz5NLdR4kW.js.download
erste-george.meditrans.it/at/oauth/erste/files/ |
220 KB 220 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Doppel-Logo_o_Claim.svg
erste-george.meditrans.it/at/oauth/erste/files/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
George-symbol.svg
erste-george.meditrans.it/at/oauth/erste/files/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bankcard.gif
erste-george.meditrans.it/at/oauth/erste/files/ |
49 KB 49 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular-webfont.woff
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Semibold-webfont.woff
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Semibold-webfont.ttf
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular-webfont.ttf
erste-george.meditrans.it/at/oauth/erste/files/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
86 B 1013 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
60 B 993 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
0 803 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)40 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| keepalive function| setupKeepaliveInterval number| FLIP_ICON_HEIGHT undefined| myWindow function| sumNumbers function| doRwd function| removeEmptyIEAlertPadding function| calcCol2Height function| calcVisibleWhiteboxHeight function| centerpage function| confirmmsg function| windowtracker function| $ function| jQuery object| reWhiteSpace function| Utf8Encode function| htmlToJsConversion function| nbalert function| setFldFocus function| isWhiteSpace function| isEmpty function| doDisableSpecifiedForm function| doSubmitAndDisable function| jsxEncrypt function| encodeToHex object| STS object| STSSecAppSecondfactor function| setFocus function| displayError function| checkUser function| submitCredentials function| submitCancelLoginForm object| STSCookieBanner boolean| ajax_disabled object| webinject_config string| eventObf function| cls undefined| unload_backup_handler object| w2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
erste-george.meditrans.it/ | Name: 4G0qy9fDDI Value: mr09lQx5NPd59GdoEApeRb39sOYnzQEa |
|
erste-george.meditrans.it/ | Name: NHIJACZdcO Value: fyt0tjaaySh2tzbPHeiAh4hvNcIGn1RN |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
erste-george.meditrans.it
login.sparkasse.at
185.2.4.84
213.150.6.28
04cf169a10f64a9ce6b5650e37e047651690b18b238e1f431636aa292d6fb600
0e6a600e56c051d8db400fb4e377807511fd627b8f5be37555bf11cf9918a3ba
48c24fd8fb19b02949a64918eb768e58dbe70210ad7de1f7f78dfc0052dfde82
5cd1c5670d6fcc29c730508ca127f6d3e8b01fe8cf0846bff248f8ddbf2fa353
b0f484443bd01c61cebbfb1c3abe4a253e3a0c314150025521712fefc3284224
b8bb52fdbcbdc0b034daee432a3eb2f3232cb0ba16a3eb527bae55cdbc4aaa96
cf262a570cc672c2b37c1a545d6a7265d9d408ebb5caba78845a761a16271f9a
d63b87f6b35187a37eb81f9a81f5b52cf33be43e1735da20d838ab8fd82fdd33
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef64cd6986101c72aa777e43872496157ecd23f9dc4770b00f47b9b4bf126f20