![](/screenshots/76bafce8-08ea-4054-9736-576da457dff7.png)
dkb.de-banking-online-transaktionen.vericleancs.com
Open in
urlscan Pro
192.99.4.202
Malicious Activity!
Public Scan
Effective URL: https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/meine.Anmelden.php?cgi_auth=Zc27wheea9gkN5ihvI8mQSYZFBqQd7mvgIjkGRzoMoc...
Submission Tags: 6832472
Submission: On November 02 via api from NL
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 31st 2020. Valid for: 3 months.
This is the only time dkb.de-banking-online-transaktionen.vericleancs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DKB (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 89.46.90.162 89.46.90.162 | 201446 (PROFESION...) (PROFESIONALHOSTING) | |
3 12 | 192.99.4.202 192.99.4.202 | 16276 (OVH) (OVH) | |
10 | 3 |
ASN16276 (OVH, FR)
PTR: server.rewathi.com
dkb.de-banking-online-transaktionen.vericleancs.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
vericleancs.com
3 redirects
dkb.de-banking-online-transaktionen.vericleancs.com |
222 KB |
1 |
tiendaunikas.com
tiendaunikas.com |
323 B |
10 | 2 |
Domain | Requested by | |
---|---|---|
12 | dkb.de-banking-online-transaktionen.vericleancs.com |
3 redirects
dkb.de-banking-online-transaktionen.vericleancs.com
|
1 | tiendaunikas.com | |
10 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.dkb.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
tiendaunikas.com Let's Encrypt Authority X3 |
2020-09-11 - 2020-12-10 |
3 months | crt.sh |
www.dkb.de-banking-online-transaktionen.vericleancs.com Let's Encrypt Authority X3 |
2020-10-31 - 2021-01-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/meine.Anmelden.php?cgi_auth=Zc27wheea9gkN5ihvI8mQSYZFBqQd7mvgIjkGRzoMocpSIunQyqTR6FWTJ1fVC7ynEfv4XwzxihoKLdo9PvatewUGzCKuQ3HZh3iUDALNBaXKgChc8p
Frame ID: 3F1D78B3E0319A1ED8A5E9BB40781455
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/76bafce8-08ea-4054-9736-576da457dff7.png)
Page URL History Show full URLs
- https://tiendaunikas.com/dkbe/ Page URL
-
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/
HTTP 302
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv HTTP 301
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/ HTTP 302
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/meine.Anmelden.php?cgi_auth=Zc27wheea9gkN5ihvI8mQSY... Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: zum Kontaktformular
Search URL Search Domain Scan URL
Title: Investor Relations
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://tiendaunikas.com/dkbe/ Page URL
-
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/
HTTP 302
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv HTTP 301
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/ HTTP 302
https://dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/meine.Anmelden.php?cgi_auth=Zc27wheea9gkN5ihvI8mQSYZFBqQd7mvgIjkGRzoMocpSIunQyqTR6FWTJ1fVC7ynEfv4XwzxihoKLdo9PvatewUGzCKuQ3HZh3iUDALNBaXKgChc8p Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
tiendaunikas.com/dkbe/ |
112 B 323 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
meine.Anmelden.php
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/ Redirect Chain
|
85 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkbDtMon_ICA23hjrx_7000200111059.htm
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
315 B 270 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb-global.css
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
263 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb_responsive.css
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
619 KB 125 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
device_optimization.htm
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
315 B 270 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ua_parser.htm
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
315 B 329 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
020_Meldung.jpg
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
button-progress-2.htm
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkb-global-print.css
dkb.de-banking-online-transaktionen.vericleancs.com/Weiter/Wrs6BpmurbftYTBSv/login_fichiers/ |
219 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
208 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
686 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
944 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
669 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
864 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
871 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DKB (Banking)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| pintHeaderEnabled function| checkEmpty object| mailboxUnreadCounterMap undefined| url number| cPosName number| cPosPin string| agent string| CL string| CR string| BK string| SH string| SP string| HS object| qwertzAlphabetic2 undefined| qwertzLayout2 undefined| qwertzLayout string| nVer string| nAgt string| browserName string| fullVersion number| majorVersion undefined| nameOffset number| verOffset number| ix string| OSName number| screenW number| screenH undefined| jToolkit undefined| jScreenSize function| fallbackToStore function| openApp function| triggerCardControlInApp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dkb.de-banking-online-transaktionen.vericleancs.com/ | Name: PHPSESSID Value: 3cc1217e0cfd02f2f845c2f1b6322ad8 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dkb.de-banking-online-transaktionen.vericleancs.com
tiendaunikas.com
192.99.4.202
89.46.90.162
0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9
1c9524bad0ee009f3f9e6af79cf3363acbcd6a4f03eec2ca8c16ff794358d81d
37c5a9c68097da45cd24b059b9e459000ba38ce7a20f298857f9c02213e0548a
3a9d6df8559323a7136024192cabaa9b231e9ae5dafae839573430e9edba9113
3e6f869a57b294f7e1e5740553380d81042d416bf10b14df84f9c9dff12ba0c9
44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af
4aac37a7fc6a662512105d96a71e6653d154b8af8db82e35aee97011e9f6586b
54d31025c9536bf38b4f89d7fdc5261bb87dfe924d7445a7d56b43533c86e8cb
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb
a552d8c9d1a47c9b54facd20d3b9ac6a8d8fa7184dbf8863b174fdb851612d3f
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e192ef893ace807106a92c606f1e4c383a6fe0c6f3274b3c580b05ac8cdccfa3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd