netbank.kws.finanzen.check24.de Open in urlscan Pro
31.13.186.65 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://netbank.kws.finanzen.check24.de/
Submission: On November 23 via api (November 23rd 2022, 3:10:13 pm UTC) from US — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 13 HTTP transactions. The main IP is 31.13.186.65, located in Germany and belongs to FIGOIO, DE. The main domain is netbank.kws.finanzen.check24.de.
TLS certificate: Issued by R3 on October 23rd 2022. Valid for: 3 months.

This is the only time netbank.kws.finanzen.check24.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	31.13.186.65 31.13.186.65	202284 (FIGOIO) (FIGOIO)
2	37.208.107.51 37.208.107.51	58010 (UVENSYS) (UVENSYS)
2	34.159.33.21 34.159.33.21	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	52.219.169.115 52.219.169.115	16509 (AMAZON-02) (AMAZON-02)
13	4

7 31.13.186.65 (Germany)

ASN202284 (FIGOIO, DE)

netbank.kws.finanzen.check24.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.208.107.51 (Limburg an der Lahn, Germany)

ASN58010 (UVENSYS, DE)
PTR: api.xs2a.com

api.xs2a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.159.33.21 (Frankfurt am Main, Germany)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 21.33.159.34.bc.googleusercontent.com

login.figo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.219.169.115 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: s3-w.eu-central-1.amazonaws.com

fnr-dev-bucket.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	check24.de netbank.kws.finanzen.check24.de	491 KB
2	amazonaws.com fnr-dev-bucket.s3.amazonaws.com	21 KB
2	figo.io login.figo.io	90 KB
2	xs2a.com api.xs2a.com — Cisco Umbrella Rank: 421210	20 KB
13	4

	Domain	Requested by
7	netbank.kws.finanzen.check24.de	netbank.kws.finanzen.check24.de
2	fnr-dev-bucket.s3.amazonaws.com	netbank.kws.finanzen.check24.de
2	login.figo.io	netbank.kws.finanzen.check24.de login.figo.io
2	api.xs2a.com	netbank.kws.finanzen.check24.de
13	4

This site contains no links.

Subject Issuer	Validity	Valid
netbank.kws.finanzen.check24.de R3	`2022-10-23` - `2023-01-21`	3 months	crt.sh
*.xs2a.com Sectigo RSA Domain Validation Secure Server CA	`2022-06-22` - `2023-07-23`	a year	crt.sh
login.figo.io R3	`2022-10-26` - `2023-01-24`	3 months	crt.sh
*.s3.amazonaws.com Amazon	`2022-09-21` - `2023-08-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://netbank.kws.finanzen.check24.de/
Frame ID: 2527DE59A5188F7EA0EB59EEC6253101
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Kontowechsel

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

622 kB
Transfer

1966 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 403
Forbidden Primary Request / Show response
netbank.kws.finanzen.check24.de/ 25 KB
26 KB 343ms
101ms Document
text/html 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to

Full URL

https://netbank.kws.finanzen.check24.de/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),

Reverse DNS

Software

ambassador /

Resource Hash

1dd6b55feb9c695a2c5b66b6ceea986ce0330b44574868348a497c72a9f9d7ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache
content-type: text/html; charset=utf-8
date: Wed, 23 Nov 2022 15:10:08 GMT
referrer-policy: strict-origin-when-cross-origin
server: ambassador
strict-transport-security: max-age=31536000; includeSubDomains
transfer-encoding: chunked
x-content-type-options: nosniff
x-download-options: noopen
x-envoy-upstream-service-time: 13
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 67103570-8cc4-4f36-a08a-ce795f45ce7c
x-runtime: 0.008800
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK xs2a.js Show response
api.xs2a.com/ 52 KB
18 KB 373ms
174ms Script
application/javascript 37.208.107.51
UVENSYS

General

Check archive.org

Show headers Download Go to

Full URL: https://api.xs2a.com/xs2a.js
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 37.208.107.51 Limburg an der Lahn, Germany, ASN58010 (UVENSYS, DE),
Reverse DNS: api.xs2a.com
Software: Apache /
Resource Hash: ba386c64e639626b46095cf999ca671b94389f1d7bf6be9b8cd7620ac9991aea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 23 Nov 2022 15:10:08 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Sep 2022 13:21:23 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Accept-Ranges: bytes
Content-Length: 18274
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK xs2a.css
api.xs2a.com/ 5 KB
2 KB 285ms
87ms Stylesheet
text/css 37.208.107.51
UVENSYS

General

Check archive.org

Show headers Download Go to

Full URL: https://api.xs2a.com/xs2a.css
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 37.208.107.51 Limburg an der Lahn, Germany, ASN58010 (UVENSYS, DE),
Reverse DNS: api.xs2a.com
Software: Apache /
Resource Hash: 2eff28638e4bd307d4c797d8e3a2bbe4715aa2696b1dd9b79f45f5d7e30e05a2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 23 Nov 2022 15:10:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 10 Jun 2022 14:29:42 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Accept-Ranges: bytes
Content-Length: 1364
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK finleap.widget.js Show response
login.figo.io/ 265 KB
87 KB 378ms
175ms Script
application/javascript 34.159.33.21
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.figo.io/finleap.widget.js
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.159.33.21 Frankfurt am Main, Germany, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 21.33.159.34.bc.googleusercontent.com
Software: envoy / Express
Resource Hash: ca354845839f19e35c37c66b598d307a58b29609efd03499e72c211d3175f366

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:08 GMT
content-encoding: gzip
server: envoy
x-powered-by: Express
vary: Accept-Encoding
transfer-encoding: chunked
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store
x-envoy-upstream-service-time: 6

GET
H/1.1 200
OK application-81e2688b15de19fb0782283d3478468bf4c923fb7488fbd62436d364ef8d62a2.css
netbank.kws.finanzen.check24.de/assets/ 376 KB
78 KB 164ms
88ms Stylesheet
text/css 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to

Full URL: https://netbank.kws.finanzen.check24.de/assets/application-81e2688b15de19fb0782283d3478468bf4c923fb7488fbd62436d364ef8d62a2.css
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),
Reverse DNS
Software: ambassador /
Resource Hash: 0161fc408528e44018149932f87abd1e6c2542f2857776409b3c7c265636aca7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:08 GMT
content-encoding: gzip
last-modified: Fri, 18 Nov 2022 10:36:29 GMT
server: ambassador
etag: "6377602d-1371d"
content-type: text/css
cache-control: max-age=315360000,public
x-envoy-upstream-service-time: 1
content-length: 79645
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK application-e8e7c39c19292707bc8c39a21f3a82b04acc0f3fb3e92131ef62d6c2b50973b0.js Show response
netbank.kws.finanzen.check24.de/assets/ 795 KB
238 KB 341ms
174ms Script
application/javascript 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to

Full URL: https://netbank.kws.finanzen.check24.de/assets/application-e8e7c39c19292707bc8c39a21f3a82b04acc0f3fb3e92131ef62d6c2b50973b0.js
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),
Reverse DNS
Software: ambassador /
Resource Hash: e8e7c39c19292707bc8c39a21f3a82b04acc0f3fb3e92131ef62d6c2b50973b0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:08 GMT
content-encoding: gzip
last-modified: Fri, 18 Nov 2022 10:36:29 GMT
server: ambassador
etag: "6377602d-3b578"
content-type: application/javascript
cache-control: max-age=315360000,public
x-envoy-upstream-service-time: 1
content-length: 243064
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK 8c6e31d95422416a8379fb792102cabc.png
fnr-dev-bucket.s3.amazonaws.com/7e/b0/77/940b736760/ 5 KB
5 KB 423ms
203ms Image
image/png 52.219.169.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fnr-dev-bucket.s3.amazonaws.com/7e/b0/77/940b736760/8c6e31d95422416a8379fb792102cabc.png
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.169.115 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-w.eu-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b1a6907331d3fcbad947bc47af1261d75d0a58820f3c2348f8bbd09b79b967d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 23 Nov 2022 15:10:09 GMT
Content-Encoding
Last-Modified: Thu, 14 Jun 2018 09:17:07 GMT
Server: AmazonS3
x-amz-request-id: CDYVVMD2NESN4PZK
ETag: "17e54b787573d07040be6314a031e0ad"
Content-Type: image/png
x-amz-meta-json: {"name":"8c6e31d95422416a8379fb792102cabc.png","model_class":"TenantLogo","model_attachment":"image"}
Accept-Ranges: bytes
Content-Length: 4878
x-amz-id-2: VuMGxL9nR7SLCU43KPSZe68gWbM1UNmvJVuzWiIgSmVFAkRpSgXPodH6xiuLbEnkZhibSnFEjnE=

GET
H/1.1 200
OK lock-header-80eb977f1c7a9392085825fecf4a2710e38fa71886928d081a83bbcf8a52505c.svg
netbank.kws.finanzen.check24.de/assets/login/ 2 KB
1 KB 92ms
90ms Image
image/svg+xml 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netbank.kws.finanzen.check24.de/assets/login/lock-header-80eb977f1c7a9392085825fecf4a2710e38fa71886928d081a83bbcf8a52505c.svg
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),
Reverse DNS
Software: ambassador /
Resource Hash: 80eb977f1c7a9392085825fecf4a2710e38fa71886928d081a83bbcf8a52505c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:09 GMT
content-encoding: gzip
last-modified: Fri, 18 Nov 2022 10:36:29 GMT
server: ambassador
etag: "6377602d-30e"
content-type: image/svg+xml
cache-control: max-age=315360000,public
x-envoy-upstream-service-time: 1
content-length: 782
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK styles.fe0ec.css
login.figo.io/ 12 KB
3 KB 114ms
113ms Stylesheet
text/css 34.159.33.21
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.figo.io/styles.fe0ec.css
Requested by: Host: login.figo.io
URL: https://login.figo.io/finleap.widget.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.159.33.21 Frankfurt am Main, Germany, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 21.33.159.34.bc.googleusercontent.com
Software: envoy / Express
Resource Hash: 0d659e036f0152fd4954e384c895c1ebaf290a921e7635013d99d47b5de7b663

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:08 GMT
content-encoding: gzip
last-modified: Mon, 21 Nov 2022 08:13:37 GMT
server: envoy
x-powered-by: Express
vary: Accept-Encoding
transfer-encoding: chunked
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
x-envoy-upstream-service-time: 25
accept-ranges: bytes

GET
H/1.1 200
OK print-6e37090988719b80b63d914afd4d74f593d3e0c755c5b0642a8478d762c906cc.css
netbank.kws.finanzen.check24.de/assets/ 124 KB
21 KB 94ms
92ms Stylesheet
text/css 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to

Full URL: https://netbank.kws.finanzen.check24.de/assets/print-6e37090988719b80b63d914afd4d74f593d3e0c755c5b0642a8478d762c906cc.css
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),
Reverse DNS
Software: ambassador /
Resource Hash: 2db30fa3bc371816a4a6fd94335521615983f425889fb13f6a4cab884a00ff5c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:09 GMT
content-encoding: gzip
last-modified: Fri, 18 Nov 2022 10:37:21 GMT
server: ambassador
etag: "63776061-5196"
content-type: text/css
cache-control: max-age=315360000,public
x-envoy-upstream-service-time: 1
content-length: 20886
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK SourceSansPro-Regular-dbdfedd3e55a6ee3c417a6a536339a8d97f3213228082d58a1265f80638db950.ttf
netbank.kws.finanzen.check24.de/assets/ 287 KB
127 KB 100ms
99ms Font
application/octet-stream 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to

Full URL: https://netbank.kws.finanzen.check24.de/assets/SourceSansPro-Regular-dbdfedd3e55a6ee3c417a6a536339a8d97f3213228082d58a1265f80638db950.ttf
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/assets/application-81e2688b15de19fb0782283d3478468bf4c923fb7488fbd62436d364ef8d62a2.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),
Reverse DNS
Software: ambassador /
Resource Hash: dbdfedd3e55a6ee3c417a6a536339a8d97f3213228082d58a1265f80638db950

Request headers

Referer: https://netbank.kws.finanzen.check24.de/assets/application-81e2688b15de19fb0782283d3478468bf4c923fb7488fbd62436d364ef8d62a2.css
Origin: https://netbank.kws.finanzen.check24.de
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:08 GMT
content-encoding: gzip
last-modified: Fri, 18 Nov 2022 10:36:56 GMT
server: ambassador
etag: "63776048-1f9ec"
content-type: application/octet-stream
cache-control: max-age=315360000,public
x-envoy-upstream-service-time: 1
content-length: 129516
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK 4414003c491e42f39ffbf2225663555c.svg
fnr-dev-bucket.s3.amazonaws.com/08/8a/a2/fd1a88ff61/ 15 KB
16 KB 362ms
236ms Image
image/svg+xml 52.219.169.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fnr-dev-bucket.s3.amazonaws.com/08/8a/a2/fd1a88ff61/4414003c491e42f39ffbf2225663555c.svg
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.169.115 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-w.eu-central-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 81834d7cbece0e9d20720e686d75984467c226019d404b0f036bbd944b324722

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date: Wed, 23 Nov 2022 15:10:10 GMT
Content-Encoding
Last-Modified: Fri, 17 Feb 2017 15:35:03 GMT
Server: AmazonS3
x-amz-request-id: 4MJA99298FJ09QPX
ETag: "f22994ffafeb8728430946ec354b656f"
Content-Type: image/svg+xml
x-amz-meta-json: {"name":"4414003c491e42f39ffbf2225663555c.svg","model_class":"TenantStyleImage","model_attachment":"image"}
Accept-Ranges: bytes
Content-Length: 15797
x-amz-id-2: aTw+OSvQMgAYQu7FT80lEVn0lpoVhfIqN4u8ER2y2n2XgGoLNUOPhxeWrZtpwhmGETrT3aKj2Lk=

GET
H/1.1 200
OK tiny_lock-3f05bd27659df22742ed9324849cb951f7a152e5cbfa4796b7b7502a64d23655.svg
netbank.kws.finanzen.check24.de/assets/ 2 KB
1012 B 183ms
88ms Image
image/svg+xml 31.13.186.65
FIGOIO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netbank.kws.finanzen.check24.de/assets/tiny_lock-3f05bd27659df22742ed9324849cb951f7a152e5cbfa4796b7b7502a64d23655.svg
Requested by: Host: netbank.kws.finanzen.check24.de
URL: https://netbank.kws.finanzen.check24.de/assets/application-81e2688b15de19fb0782283d3478468bf4c923fb7488fbd62436d364ef8d62a2.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 31.13.186.65 , Germany, ASN202284 (FIGOIO, DE),
Reverse DNS
Software: ambassador /
Resource Hash: 3f05bd27659df22742ed9324849cb951f7a152e5cbfa4796b7b7502a64d23655

Request headers

accept-language: en-US,en;q=0.9
Referer: https://netbank.kws.finanzen.check24.de/assets/application-81e2688b15de19fb0782283d3478468bf4c923fb7488fbd62436d364ef8d62a2.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 15:10:09 GMT
content-encoding: gzip
last-modified: Fri, 18 Nov 2022 10:36:29 GMT
server: ambassador
etag: "6377602d-2a7"
content-type: image/svg+xml
cache-control: max-age=315360000,public
x-envoy-upstream-service-time: 1
content-length: 679
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			netbank.kws.finanzen.check24.de/	1969-12-31 23:59:59	Name: _switch_session Value: Kv%2BgBAAHbCHQz67edeIzs8%2FEVJ5wUum1ecIopMy4SJGkwfQdZ5srSvJ9BVeuh0xUtDld66rXPfnoYpiWF8uD%2FQWFz%2BAOsPpRFV8axjkjpVR9FJVR3pQv8Sim5Y1kQ3TGzFW7CgHuruPq4QX4ZniV5QSFZ9U8VthMWdUby6Sg4ZXx4d68--v1rkmIkho3aK0SBK--0Qcf41oTj9nLkzzWjnRjCQ%3D%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://netbank.kws.finanzen.check24.de/ Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.xs2a.com
fnr-dev-bucket.s3.amazonaws.com
login.figo.io
netbank.kws.finanzen.check24.de
31.13.186.65
34.159.33.21
37.208.107.51
52.219.169.115
0161fc408528e44018149932f87abd1e6c2542f2857776409b3c7c265636aca7
0d659e036f0152fd4954e384c895c1ebaf290a921e7635013d99d47b5de7b663
1dd6b55feb9c695a2c5b66b6ceea986ce0330b44574868348a497c72a9f9d7ed
2db30fa3bc371816a4a6fd94335521615983f425889fb13f6a4cab884a00ff5c
2eff28638e4bd307d4c797d8e3a2bbe4715aa2696b1dd9b79f45f5d7e30e05a2
3f05bd27659df22742ed9324849cb951f7a152e5cbfa4796b7b7502a64d23655
80eb977f1c7a9392085825fecf4a2710e38fa71886928d081a83bbcf8a52505c
81834d7cbece0e9d20720e686d75984467c226019d404b0f036bbd944b324722
b1a6907331d3fcbad947bc47af1261d75d0a58820f3c2348f8bbd09b79b967d8
ba386c64e639626b46095cf999ca671b94389f1d7bf6be9b8cd7620ac9991aea
ca354845839f19e35c37c66b598d307a58b29609efd03499e72c211d3175f366
dbdfedd3e55a6ee3c417a6a536339a8d97f3213228082d58a1265f80638db950
e8e7c39c19292707bc8c39a21f3a82b04acc0f3fb3e92131ef62d6c2b50973b0

netbank.kws.finanzen.check24.de Open in urlscan Pro 31.13.186.65 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

622 kBTransfer

1966 kBSize

1 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

28 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

netbank.kws.finanzen.check24.de Open in urlscan Pro
31.13.186.65 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

622 kB
Transfer

1966 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!