urlscan.io logo urlscan.io
SecurityTrails logo

svavasasat-feredop1.siekertech.com Open in urlscan Pro
192.185.52.205  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://svavasasat-feredop1.siekertech.com/
Submission: On January 08 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 192.185.52.205, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is svavasasat-feredop1.siekertech.com.
TLS certificate: Issued by R3 on December 7th 2023. Valid for: 3 months.
This is the only time svavasasat-feredop1.siekertech.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 192.185.52.205 19871 (NETWORK-S...)
1 176.74.24.122 38719 (DREAMSCAP...)
2 4
Apex Domain
Subdomains		 Transfer
1 dreamwp.com
gfxf9ppj.dreamwp.com
184 KB
1 siekertech.com
svavasasat-feredop1.siekertech.com
1 KB
2 2
Domain Requested by
1 gfxf9ppj.dreamwp.com text
1 svavasasat-feredop1.siekertech.com
2 2

This site contains no links.

Subject Issuer Validity Valid
*.siekertech.com
R3		 2023-12-07 -
2024-03-06		 3 months crt.sh
*.dreamwp.com
Sectigo RSA Domain Validation Secure Server CA		 2023-01-04 -
2024-01-15		 a year crt.sh

This page contains 3 frames:

Primary Page: https://svavasasat-feredop1.siekertech.com/
Frame ID: 43E71CB34FD80374AA9C9FEB4E7804AF
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 01EDF1AD6E05AFF59E878EA17692A6A6
Requests: 1 HTTP requests in this frame

Frame: https://gfxf9ppj.dreamwp.com/wp-admin/maint/wasd/ingapp/mein/hakona/iop/
Frame ID: 54EE88E6933F1E6640CE5D81065F6DB1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Anmelden ING

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

276 kB
Transfer

467 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
svavasasat-feredop1.siekertech.com/ 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://svavasasat-feredop1.siekertech.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.52.205 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-52-205.unifiedlayer.com
Software
Apache /
Resource Hash
28019659b35cafeeb7eb480fb2c61c7da0bc19788a056797513051ffe98456bb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-encoding
gzip
content-length
1272
content-type
text/html; charset=UTF-8
date
Mon, 08 Jan 2024 23:17:15 GMT
server
Apache
vary
Accept-Encoding
truncated
/ Frame 01ED 		820 B
820 B 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
372d595d736809347d47d4b3e8bd887e239195f62fc4b6ea829d02d56194c4bb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Content-Type
text/html
/
gfxf9ppj.dreamwp.com/wp-admin/maint/wasd/ingapp/mein/hakona/iop/ Frame 54EE 		312 KB
184 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gfxf9ppj.dreamwp.com/wp-admin/maint/wasd/ingapp/mein/hakona/iop/
Requested by
Host: text
URL: data:text/html;base64,PGh0bWw+IDxtZXRhIGNoYXJzZXQ9InV0Zi04Ij4gPGxpbmsgcmVsPSJpY29uIiBocmVmPSIuL2Zhdmljb24uaWNvIj4gPHRpdGxlPldlIGFyZSBEUEQgLSBEUEQ8L3RpdGxlPiA8c2NyaXB0PiBkb2N1bWVudC5vbmtleWRvd24gPSBmdW5jdGlvbihlKSB7IGlmKGV2ZW50LmtleUNvZGUgPT0gMTIzKSB7IHJldHVybiBmYWxzZTsgfSBpZihlLmN0cmxLZXkgJiYgZS5zaGlmdEtleSAmJiBlLmtleUNvZGUgPT0gJ0knLmNoYXJDb2RlQXQoMCkpIHsgcmV0dXJuIGZhbHNlOyB9IGlmKGUuY3RybEtleSAmJiBlLnNoaWZ0S2V5ICYmIGUua2V5Q29kZSA9PSAnSicuY2hhckNvZGVBdCgwKSkgeyByZXR1cm4gZmFsc2U7IH0gaWYoZS5jdHJsS2V5ICYmIGUua2V5Q29kZSA9PSAnVScuY2hhckNvZGVBdCgwKSkgeyByZXR1cm4gZmFsc2U7IH0gfSBkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdjb250ZXh0bWVudScsIGZ1bmN0aW9uKGUpIHsgZS5wcmV2ZW50RGVmYXVsdCgpOyB9KTsgPC9zY3JpcHQ+IDxoZWFkPiA8c3R5bGUgdHlwZT0idGV4dC9jc3MiPiBib2R5IHsgbWFyZ2luOiAwOyBvdmVyZmxvdzogaGlkZGVuOyB9ICNpZnJhbWUxIHsgaGVpZ2h0OiAxMDAlOyBsZWZ0OiAwcHg7IHBvc2l0aW9uOiBhYnNvbHV0ZTsgdG9wOiAwcHg7IHdpZHRoOiAxMDAlOyB9IDwvc3R5bGU+IDwvaGVhZD4gPGJvZHk+IDxpZnJhbWUgaWQ9ImlmcmFtZTEiIHNyYz0iaHR0cHM6Ly9nZnhmOXBwai5kcmVhbXdwLmNvbS93cC1hZG1pbi9tYWludC93YXNkL2luZ2FwcC9tZWluL2hha29uYS9pb3AvIiBmcmFtZWJvcmRlcj0iMCI+PC9pZnJhbWU+IDwvYm9keT4gPC9odG1sPg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
176.74.24.122 London, United Kingdom, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
ipb04a187a.ipv4.lon01.ds.network
Software
nginx /
Resource Hash
b8a6acbde09d8b3e60da31f00c8b7ea7e7a292ae0f88f7a20028f3b1ff2e3099

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
max-age=7200
content-encoding
gzip
content-type
text/html
date
Mon, 08 Jan 2024 23:17:16 GMT
expires
Tue, 09 Jan 2024 01:17:16 GMT
last-modified
Mon, 03 Apr 2023 02:55:16 GMT
server
nginx
vary
Accept-Encoding
x-newfold-cache-level
2
truncated
/ Frame 54EE 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1470546a5f8d7a68deb045a9f3be48c3fa818c53c0b4f8c854d6acdec64aa225

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 54EE 		44 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 54EE 		16 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 54EE 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e

Request headers

Referer
Origin
https://gfxf9ppj.dreamwp.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ Frame 54EE 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155

Request headers

Referer
Origin
https://gfxf9ppj.dreamwp.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ Frame 54EE 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8

Request headers

Referer
Origin
https://gfxf9ppj.dreamwp.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture

0 Cookies

1 Console Messages

Source Level URL
Text
security error URL: https://gfxf9ppj.dreamwp.com/wp-admin/maint/wasd/ingapp/mein/hakona/iop/(Line 78)
Message:
Blocked autofocusing on a <input> element in a cross-origin subframe.