kunde-dkbs-de.com
Open in
urlscan Pro
91.229.90.152
Malicious Activity!
Public Scan
Effective URL: https://kunde-dkbs-de.com/web/login.php?authId=278448e6da8a993889474277ce5d0099a9cc7bbf
Submission: On June 05 via api from JP — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 2nd 2023. Valid for: 3 months.
This is the only time kunde-dkbs-de.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DKB (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 12 | 91.229.90.152 91.229.90.152 | 51659 (ASBAXET) (ASBAXET) | |
2 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::200a | 15169 (GOOGLE) (GOOGLE) | |
13 | 4 |
ASN51659 (ASBAXET, RU)
PTR: ha003.justhost.ru
kunde-dkbs-de.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
kunde-dkbs-de.com
2 redirects
kunde-dkbs-de.com |
314 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 367 |
145 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 66 |
886 B |
13 | 3 |
Domain | Requested by | |
---|---|---|
12 | kunde-dkbs-de.com |
2 redirects
kunde-dkbs-de.com
|
2 | cdn.jsdelivr.net |
kunde-dkbs-de.com
cdn.jsdelivr.net |
1 | fonts.googleapis.com |
cdn.jsdelivr.net
|
13 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
kunde-dkbs-de.com R3 |
2023-06-02 - 2023-08-31 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kunde-dkbs-de.com/web/login.php?authId=278448e6da8a993889474277ce5d0099a9cc7bbf
Frame ID: 13D1C588E8992EB8E5585859FE64B815
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Willkommen,Page URL History Show full URLs
-
https://kunde-dkbs-de.com/
HTTP 302
https://kunde-dkbs-de.com/web/index.php?status=checked&authId=f3d38a1a55acd1747128ce8eae30e75c87120823 HTTP 302
https://kunde-dkbs-de.com/web/login.php?authId=278448e6da8a993889474277ce5d0099a9cc7bbf Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Semantic UI (UI frameworks) Expand
Detected patterns
- <link[^>]+semantic(?:\.min)\.css"
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://kunde-dkbs-de.com/
HTTP 302
https://kunde-dkbs-de.com/web/index.php?status=checked&authId=f3d38a1a55acd1747128ce8eae30e75c87120823 HTTP 302
https://kunde-dkbs-de.com/web/login.php?authId=278448e6da8a993889474277ce5d0099a9cc7bbf Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
kunde-dkbs-de.com/web/ Redirect Chain
|
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
semantic.min.css
cdn.jsdelivr.net/npm/semantic-ui@2.4.2/dist/ |
614 KB 106 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
kunde-dkbs-de.com/web/layout/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
kunde-dkbs-de.com/web/layout/js/ |
837 KB 245 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
kunde-dkbs-de.com/web/layout/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
search.png
kunde-dkbs-de.com/web/layout/img/ |
650 B 684 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aside_1.png
kunde-dkbs-de.com/web/layout/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner_1.png
kunde-dkbs-de.com/web/layout/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keyboard.png
kunde-dkbs-de.com/web/layout/img/ |
315 B 372 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aside_2.png
kunde-dkbs-de.com/web/layout/img/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer.png
kunde-dkbs-de.com/web/layout/img/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 886 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 17 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icons.woff2
cdn.jsdelivr.net/npm/semantic-ui@2.4.2/dist/themes/default/assets/fonts/ |
39 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DKB (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| Modernizr function| $ function| jQuery string| get string| set1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kunde-dkbs-de.com/ | Name: PHPSESSID Value: 94516d6296d3a19dbbab6a9a407f2d28 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
fonts.googleapis.com
kunde-dkbs-de.com
2a00:1450:4001:803::200a
2a04:4e42:200::485
91.229.90.152
09347f6a4e4d4863e0a665b0bff9c9d17a5b022b4fff6ceb185c3dde0f087494
14b35e728a11ebaa486217f6c05103335902d1bdcbe2e7640a6df44f8b7f936a
20887aa995532d3a50cc4e65454d8e5e0a0ecc7862c465b12a4478972885bed1
2362595d4adabb5a7119d6ac37ab03d9e39ffc5ed49bd41adfbc0ffddc14b7ed
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3
5177ac8b16de2e407f518c554f3ba3fe0837f8b333830026837cc3f82e190124
51dd2d5cd058a7c9eecae574a2896089032ee1e7c35adf3b0a9dfa2549e7fe5d
6411eb1ecba92d02d6a307d2525bcd82035595ef20a83c202aee3d783b888653
699e8cb3d0af7f12172315152a58cf8154526ddc2ee3d29ed8861218e9cf91a2
69d23c696ace7e88ea64474450d8cc42f27fe298e268c60a4c0f9e4d375a45c3
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171
96ecab11ca4a18e2fa96a9b5683187ad779b2762f1ae904ed65aebe0d7247cc2
bab7919e0149a370a98daf257d95a2d5839d21bfe04bb2fb6a7671983c7530de
e78a7546181abd93801044ffa526b2716da93bfdf3062f68ebf51fb7327dd6ef
fa295dc1cfa80e81335e66cef5dfba30a471373c422c611d27f2c9c5f321ab90