www.kunde-1webservices-online.com
Open in
urlscan Pro
2606:4700:30::6818:654f
Malicious Activity!
Public Scan
Effective URL: https://www.kunde-1webservices-online.com/login-online-banking.html?419888888586=EGDYwE4EumbsfHl&558100099977736303=1ZQF4u9rGCGn&919830830738
Submission: On November 26 via automatic, source phishtank
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 25th 2019. Valid for: 10 months.
This is the only time www.kunde-1webservices-online.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 166.62.121.60 166.62.121.60 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 1 | 178.162.136.25 178.162.136.25 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
2 13 | 2606:4700:30:... 2606:4700:30::6818:654f | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
11 | 1 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-121-60.ip.secureserver.net
s.abovopro.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.kunde-1webservices-online.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
kunde-1webservices-online.com
2 redirects
www.kunde-1webservices-online.com |
195 KB |
1 |
abovopro.com
1 redirects
s.abovopro.com |
276 B |
11 | 2 |
Domain | Requested by | |
---|---|---|
13 | www.kunde-1webservices-online.com |
2 redirects
www.kunde-1webservices-online.com
|
1 | s.abovopro.com | 1 redirects |
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-11-25 - 2020-10-09 |
10 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.kunde-1webservices-online.com/login-online-banking.html?419888888586=EGDYwE4EumbsfHl&558100099977736303=1ZQF4u9rGCGn&919830830738
Frame ID: 6D88E4DEB1023CBE9F71B1C571A3B2CF
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://s.abovopro.com/1d
HTTP 301
http://178.162.136.25/ HTTP 302
http://www.kunde-1webservices-online.com/einloggen/verifizierung HTTP 301
https://www.kunde-1webservices-online.com/einloggen/verifizierung HTTP 302
https://www.kunde-1webservices-online.com/login-online-banking.html?419888888586=EGDYwE4EumbsfHl&558100099977736303=1Z... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://s.abovopro.com/1d
HTTP 301
http://178.162.136.25/ HTTP 302
http://www.kunde-1webservices-online.com/einloggen/verifizierung HTTP 301
https://www.kunde-1webservices-online.com/einloggen/verifizierung HTTP 302
https://www.kunde-1webservices-online.com/login-online-banking.html?419888888586=EGDYwE4EumbsfHl&558100099977736303=1ZQF4u9rGCGn&919830830738 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login-online-banking.html
www.kunde-1webservices-online.com/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BoAMNoGYc7ZOYuwhbQ1Lh
www.kunde-1webservices-online.com/ |
14 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BSzljw63TQsZtuoNTbO
www.kunde-1webservices-online.com/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BU08iqqgTbA8LhdPeinoB5V
www.kunde-1webservices-online.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bdg0ZMhPbo7AZUnnAmAImpHQ
www.kunde-1webservices-online.com/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BtI5jWoHk0Ng8rdDEzZ4xguEQ
www.kunde-1webservices-online.com/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
B1BRuHiHkKzqPsZaLvgPo7
www.kunde-1webservices-online.com/ |
4 KB 1 KB |
Script
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BAqJeknlBYK5IEpLuGDlm
www.kunde-1webservices-online.com/ |
47 KB 47 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BYHk7Ua7bHVSDS1LdKwbFAmO0
www.kunde-1webservices-online.com/ |
39 KB 39 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BQxDolpIeUFyb7y5UVspxHSM
www.kunde-1webservices-online.com/ |
27 KB 27 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BloG92LSCi0Kx1EsD0ugqWL
www.kunde-1webservices-online.com/ |
39 KB 39 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| BtqowQnfeRge03qkjyaoivTx function| BzMU6f9v0EUOzEV3zsQZRawAN2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.kunde-1webservices-online.com/ | Name: PHPSESSID Value: p5dj12785hmb6cme8ii03jj9h0 |
|
.kunde-1webservices-online.com/ | Name: __cfduid Value: da7d23919ac3faaf351fed7b98d2c67711574767422 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s.abovopro.com
www.kunde-1webservices-online.com
166.62.121.60
178.162.136.25
2606:4700:30::6818:654f
133ad01e7b25970c5cbcce3d8ffb7f23eef311c5950d9fcf27463c49e9ae3f02
181b3df067913c04fc88c9f2b2960cb8467e845941ce1163abf96146250559a5
1ab337962df7162cbc12f80783277dbcf416959d80ec88a2c990d6f1a98c3f24
4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753
847ff4924115088cd0694708040f1faadfa2c4b1948d4f57933825b2d08b58f7
8565dc9336899fe2c991d29d7ba2a9e589db7bfe63bdd7749fe962a92993f0b3
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
bc4b0c1b29bfc9a420b7a21150a764688407e7bc3c976cf62b1dec5237a13e99
bce9cd38cb4bde0937b17ec2d37813b68d7d6a170161fc150be6b411d73db54d
c7ac16e506a09e0903c6a7e6d003d6f432349b5bae60f347384da07bd7093947
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638