apps.n26.de.20-254-36-6.cprapid.com Open in urlscan Pro
20.254.36.6 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://s3.amazonaws.com/safiepace/refn26.html
Effective URL:
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/
Submission: On August 03 via automatic, source phishtank (August 3rd 2022, 2:28:11 pm UTC) — Scanned from DE

Summary HTTP 17 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 17 HTTP transactions. The main IP is 20.254.36.6, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is apps.n26.de.20-254-36-6.cprapid.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 29th 2022. Valid for: a year.

This is the only time apps.n26.de.20-254-36-6.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: N26 (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	52.216.20.19 52.216.20.19	16509 (AMAZON-02) (AMAZON-02)
2 16	20.254.36.6 20.254.36.6	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
17	3

1 52.216.20.19 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 20.254.36.6 (London, United Kingdom) 2 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

apps.n26.de.20-254-36-6.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	cprapid.com 2 redirects apps.n26.de.20-254-36-6.cprapid.com	517 KB
1	amazonaws.com s3.amazonaws.com	451 B
17	2

	Domain	Requested by
16	apps.n26.de.20-254-36-6.cprapid.com	2 redirects apps.n26.de.20-254-36-6.cprapid.com
1	s3.amazonaws.com
17	2

This site contains links to these domains. Also see Links.

Domain
docs.n26.com
n26.com

Subject Issuer	Validity	Valid
s3.amazonaws.com Amazon	`2022-04-01` - `2023-03-30`	a year	crt.sh
apps.n26.de.20-254-36-6.cprapid.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-29` - `2023-07-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/
Frame ID: 8DE19D40A11141F1C752932F11CDE085
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

N26

Page URL History Show full URLs

https://s3.amazonaws.com/safiepace/refn26.html Page URL
https://apps.n26.de.20-254-36-6.cprapid.com/de/ Page URL
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c HTTP 301
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/ HTTP 302
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

558 kB
Transfer

553 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://docs.n26.com/legal/01+DE/03+Privacy%20Policy/de/01privacy-policy-de.pdf
Title: Datenschutzbestimmungen (neuen Tab)

Search URL Search Domain Scan URL

URL: https://n26.com/de-de/impressum
Title: Impressum (neuen Tab)

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s3.amazonaws.com/safiepace/refn26.html Page URL
https://apps.n26.de.20-254-36-6.cprapid.com/de/ Page URL
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c HTTP 301
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/ HTTP 302
https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	refn26.html s3.amazonaws.com/safiepace/	96 B 451 B	406ms 115ms	Document text/html	52.216.20.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/safiepace/refn26.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.20.19 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Content-Length 96 Content-Type text/html Date Wed, 03 Aug 2022 14:28:10 GMT ETag "acab3247dcd0f0df8b1e70ad780aff6b" Last-Modified Fri, 29 Jul 2022 12:38:03 GMT Server AmazonS3 x-amz-id-2 ftXqvz78fbL+LK6Sgo2DThFA3emx9aY80EkuIwAUR5+Ki+Yq5VPTiDMTZWFsU5UybII6XoFHLu0= x-amz-request-id 7R7075ZHZECE80RW
GET H/1.1	200 OK	/ Show response apps.n26.de.20-254-36-6.cprapid.com/de/	663 B 892 B	113ms 58ms	Document text/html	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `5c8d81e0a7a9e64ccfa8967a7c4df7e2a004315e3a82d4b65a71068ad72733a5` Request headers Referer https://s3.amazonaws.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 03 Aug 2022 14:28:08 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	Primary Request / Show response apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/ Redirect Chain https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c? https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/? https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?	206 KB 207 KB	48ms 46ms	Document text/html	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `5134e51e2673d5727111c86be4d711155c3e089f786456e769ff19ea49c2dd9b` Request headers Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 03 Aug 2022 14:28:09 GMT Keep-Alive timeout=5, max=97 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 03 Aug 2022 14:28:09 GMT Keep-Alive timeout=5, max=98 Server Apache Transfer-Encoding chunked location login/?
GET H/1.1	200 OK	jquery.min.js Show response apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/jquery/dist/	85 KB 85 KB	23ms 22ms	Script application/javascript	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/jquery/dist/jquery.min.js Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Mon, 05 Jun 2017 05:55:06 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 86659 Expires 0
GET H/1.1	200 OK	ua-parser.min.js Show response apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/ua-parser-js/dist/	17 KB 17 KB	65ms 21ms	Script application/javascript	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Thu, 12 Oct 2017 10:16:24 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17048 Expires 0
GET H/1.1	200 OK	font-awesome.min.css apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/font-awesome/css/	30 KB 31 KB	64ms 21ms	Stylesheet text/css	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Sun, 09 Apr 2017 06:29:24 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 31000 Expires 0
GET H/1.1	200 OK	core_form.js Show response apps.n26.de.20-254-36-6.cprapid.com/de/core/form/	17 KB 18 KB	87ms 21ms	Script application/javascript	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/core/form/core_form.js Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `49c0dcad8e7009a40fe85c3a80b8911e05622cc79ac7af010eafcd96c3a697f7` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Sat, 02 Jul 2022 13:34:58 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 17713 Expires 0
GET H/1.1	200 OK	core_token.js Show response apps.n26.de.20-254-36-6.cprapid.com/de/core/token/	13 KB 13 KB	86ms 20ms	Script application/javascript	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/core/token/core_token.js Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `a870bff8b5479904fd6004cabb22681104a2447e1eedac6e0b1c128718e8ce40` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Thu, 20 Feb 2020 16:33:12 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 12935 Expires 0
GET H/1.1	200 OK	core_form.css apps.n26.de.20-254-36-6.cprapid.com/de/core/form/	3 KB 3 KB	64ms 22ms	Stylesheet text/css	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/core/form/core_form.css Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `0d1780e1dd7d40617aa6e101b01a74452c0efad8a64c71685b97839a7a40b2e7` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Wed, 12 Feb 2020 15:02:10 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2750 Expires 0
GET H/1.1	200 OK	css.css apps.n26.de.20-254-36-6.cprapid.com/de/login/form/	167 B 490 B	64ms 21ms	Stylesheet text/css	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/login/form/css.css Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `cc51d748a03b410bc5b12fd6fc6698ce1568d2a1c18eca477763f8149347e83d` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Tue, 11 Feb 2020 21:40:46 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 167 Expires 0
GET H/1.1	200 OK	form.js Show response apps.n26.de.20-254-36-6.cprapid.com/de/login/form/	3 KB 3 KB	24ms 19ms	Script application/javascript	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/login/form/form.js?v=62ea85f989ead Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Fri, 06 Dec 2019 20:03:58 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 3063 Expires 0
GET H/1.1	200 OK	token.js Show response apps.n26.de.20-254-36-6.cprapid.com/de/login/token/	1 KB 2 KB	26ms 18ms	Script application/javascript	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/login/token/token.js?v=62ea85f989eb3 Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `4990eba8e4dc4cb12cba3e92aad405f4a41a7d60146b85e0b7857502eb53a293` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Wed, 12 Feb 2020 08:32:02 GMT Server Apache Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1289 Expires 0
GET DATA	200 OK	truncated /	13 KB 13 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `57b016225d321a77e0a129515f4436a9bcd53cd6ba8dcd32a96b95ec55d7a785` Request headers Referer Origin https://apps.n26.de.20-254-36-6.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	14 KB 14 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c6a5e2cf7945573c6e7c595d5875a6bb3696cfb5b5783209cd3ed5c1c8ed9b9f` Request headers Referer Origin https://apps.n26.de.20-254-36-6.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	14 KB 14 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e1c2d323b6b5d86a647a34092f9c18b935f807b46f924578865a738f7b518f10` Request headers Referer Origin https://apps.n26.de.20-254-36-6.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type font/woff2
GET H/1.1	200 OK	fontawesome-webfont.woff2 apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/font-awesome/fonts/	75 KB 76 KB	19ms 18ms	Font font/woff2	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/font-awesome/css/font-awesome.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe` Request headers Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/bower_components/font-awesome/css/font-awesome.min.css Origin https://apps.n26.de.20-254-36-6.cprapid.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Sun, 09 Apr 2017 06:29:24 GMT Server Apache Content-Type font/woff2 Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 77160 Expires 0
GET H/1.1	200 OK	logo-poste-italiane@2x.png apps.n26.de.20-254-36-6.cprapid.com/de/login/	3 KB 4 KB	19ms 19ms	Image image/png	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/login/logo-poste-italiane@2x.png Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `0de71b76182b9403d178a1014981408fa55ae45fecd31b40577a0417c00aa6ed` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Sat, 02 Jul 2022 13:31:26 GMT Server Apache Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 3447 Expires 0
GET H/1.1	200 OK	spinner_giallo.gif apps.n26.de.20-254-36-6.cprapid.com/de/login/	58 KB 58 KB	20ms 19ms	Image image/gif	20.254.36.6 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://apps.n26.de.20-254-36-6.cprapid.com/de/login/spinner_giallo.gif Requested by Host: apps.n26.de.20-254-36-6.cprapid.com URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.254.36.6 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `02e5c801b1246dc5c65728d61ff759cb8fa022575e3165ec50e730f76a138317` Request headers accept-language de-DE,de;q=0.9 Referer https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/? User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 03 Aug 2022 14:28:09 GMT Last-Modified Mon, 14 Dec 2020 12:46:26 GMT Server Apache Content-Type image/gif Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 58889 Expires 0
GET		home.php apps.n26.de.20-254-36-6.cprapid.com/de/	0 0

GET		home.php apps.n26.de.20-254-36-6.cprapid.com/de/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: apps.n26.de.20-254-36-6.cprapid.com
URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/home.php?pl=token&link=n26&bid=db974d41b5d0db24b5087d5aad89236c&callback=jQuery321018939478527082976_1659536888235&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1659536888236

Domain: apps.n26.de.20-254-36-6.cprapid.com
URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/home.php?pl=token&link=n26&bid=db974d41b5d0db24b5087d5aad89236c&callback=jQuery321018939478527082976_1659536888237&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1659536888238

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: N26 (Banking)

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			apps.n26.de.20-254-36-6.cprapid.com/de	1969-12-31 23:59:59	Name: real Value: OK
			apps.n26.de.20-254-36-6.cprapid.com/	1970-01-20 05:42:08	Name: bid Value: db974d41b5d0db24b5087d5aad89236c

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 26) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 27) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 461) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 462) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 463) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 464) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 465) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 466) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 467) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 468) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 469) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://apps.n26.de.20-254-36-6.cprapid.com/de/a1b2c3/db974d41b5d0db24b5087d5aad89236c/login/?(Line 470) Message: <link rel=preload> has an invalid `href` value

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apps.n26.de.20-254-36-6.cprapid.com
s3.amazonaws.com
apps.n26.de.20-254-36-6.cprapid.com
20.254.36.6
52.216.20.19
02e5c801b1246dc5c65728d61ff759cb8fa022575e3165ec50e730f76a138317
0d1780e1dd7d40617aa6e101b01a74452c0efad8a64c71685b97839a7a40b2e7
0de71b76182b9403d178a1014981408fa55ae45fecd31b40577a0417c00aa6ed
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
4990eba8e4dc4cb12cba3e92aad405f4a41a7d60146b85e0b7857502eb53a293
49c0dcad8e7009a40fe85c3a80b8911e05622cc79ac7af010eafcd96c3a697f7
5134e51e2673d5727111c86be4d711155c3e089f786456e769ff19ea49c2dd9b
57b016225d321a77e0a129515f4436a9bcd53cd6ba8dcd32a96b95ec55d7a785
5c8d81e0a7a9e64ccfa8967a7c4df7e2a004315e3a82d4b65a71068ad72733a5
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
a870bff8b5479904fd6004cabb22681104a2447e1eedac6e0b1c128718e8ce40
c6a5e2cf7945573c6e7c595d5875a6bb3696cfb5b5783209cd3ed5c1c8ed9b9f
cc51d748a03b410bc5b12fd6fc6698ce1568d2a1c18eca477763f8149347e83d
e1c2d323b6b5d86a647a34092f9c18b935f807b46f924578865a738f7b518f10

apps.n26.de.20-254-36-6.cprapid.com Open in urlscan Pro 20.254.36.6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

88 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

558 kBTransfer

553 kBSize

2 Cookies

2 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

51 JavaScript Global Variables

2 Cookies

12 Console Messages

Indicators

apps.n26.de.20-254-36-6.cprapid.com Open in urlscan Pro
20.254.36.6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

558 kB
Transfer

553 kB
Size

2
Cookies

17 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!