landes-service.herokuapp.com Open in urlscan Pro
54.156.188.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
Submission: On September 03 via automatic, source phishtank (September 3rd 2018, 2:19:23 pm UTC)

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 54.156.188.154, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is landes-service.herokuapp.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on April 19th 2017. Valid for: 3 years.

This is the only time landes-service.herokuapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Landesbank Berlin (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	54.156.188.154 54.156.188.154	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
14	178.128.202.129 178.128.202.129	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1	104.20.208.21 104.20.208.21	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
16	3

1 54.156.188.154 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-156-188-154.compute-1.amazonaws.com

landes-service.herokuapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 178.128.202.129 (Greece)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

msdn-lbb-de.netlify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.20.208.21 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

pastebin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	netlify.com msdn-lbb-de.netlify.com	75 KB
1	pastebin.com pastebin.com	4 KB
1	herokuapp.com landes-service.herokuapp.com	10 KB
16	3

	Domain	Requested by
14	msdn-lbb-de.netlify.com	landes-service.herokuapp.com
1	pastebin.com	landes-service.herokuapp.com
1	landes-service.herokuapp.com
16	3

This site contains no links.

Subject Issuer	Validity	Valid
*.herokuapp.com DigiCert SHA2 High Assurance Server CA	`2017-04-19` - `2020-06-22`	3 years	crt.sh
*.netlify.com AlphaSSL CA - SHA256 - G2	`2016-11-23` - `2018-11-24`	2 years	crt.sh
ssl509085.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-04-27` - `2018-11-03`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
Frame ID: 4803173474D16C9A6E91F60700C78DB3
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

90 kB
Transfer

173 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set dispatch.php Show response
landes-service.herokuapp.com/l/bin/ 10 KB
10 KB 446ms
147ms Document
text/html 54.156.188.154
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.156.188.154 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-156-188-154.compute-1.amazonaws.com
Software: Apache /
Resource Hash: c160d80e3f1f217dc516c3f72f06eab6a77bf97de8876c76ceb97646c1e08c75

Request headers

Host: landes-service.herokuapp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 4803173474D16C9A6E91F60700C78DB3

Response headers

Connection: keep-alive
Date: Mon, 03 Sep 2018 14:19:12 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=3r3gfpvj124qk4n0j7m28mglb1; path=/
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Via: 1.1 vegur

GET
S 200 lbb.css
msdn-lbb-de.netlify.com/css/ 8 KB
2 KB 85ms
6ms Stylesheet
text/css 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://msdn-lbb-de.netlify.com/css/lbb.css

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

4b842affe29896a5f5b945a32191a795b5aaf47a694a05c471c4a25057a8e90b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003848
date: Mon, 03 Sep 2018 13:43:55 GMT
content-encoding: gzip
server: Netlify
age: 2117
etag: "8ab4ac0d810b2eb34cf542337662c0dc-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1721

GET
S 200 Titellogo1.gif
msdn-lbb-de.netlify.com/img/ 43 B
146 B 85ms
7ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/Titellogo1.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003850
date: Mon, 03 Sep 2018 13:43:55 GMT
server: Netlify
age: 2117
etag: "647ed87664e564ec68421b7e58f7eb87-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 43

GET
S 200 LBB_login_links.gif
msdn-lbb-de.netlify.com/img/ 59 B
154 B 37ms
36ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/LBB_login_links.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

34e7d2a8a056c839bc78c85e05fb8f8a4989a94dd78697b6237ba15f749d0484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003869
date: Mon, 03 Sep 2018 13:43:55 GMT
server: Netlify
age: 2117
etag: "9c2be2689cf4958a8335958745f7d5f2-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 59

GET
S 200 metaarea.gif
msdn-lbb-de.netlify.com/img/ 49 B
143 B 37ms
36ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/metaarea.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003872
date: Mon, 03 Sep 2018 13:43:55 GMT
server: Netlify
age: 2117
etag: "6c2159777928184f26d0262612b1d9dc-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 49

GET
S 200 Banklogo.gif
msdn-lbb-de.netlify.com/img/ 43 B
104 B 37ms
35ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/Banklogo.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003870
date: Mon, 03 Sep 2018 13:43:55 GMT
server: Netlify
age: 2117
etag: "647ed87664e564ec68421b7e58f7eb87-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 43

GET
S 200 LBB_login_rechts.gif
msdn-lbb-de.netlify.com/img/ 11 KB
11 KB 39ms
38ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/LBB_login_rechts.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

dba31482c5758be14143eec2611b9bf10a06d7c5563a653b3ae7c75711c1f246

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003871
date: Mon, 03 Sep 2018 13:43:55 GMT
server: Netlify
age: 2117
etag: "d57bfa9ec32951b4a7293c1af64cd7b4-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 10756

GET
S 200 jquery.min.js Show response
msdn-lbb-de.netlify.com/js/ 85 KB
30 KB 71ms
8ms Script
application/javascript 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://msdn-lbb-de.netlify.com/js/jquery.min.js

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003849
date: Mon, 03 Sep 2018 13:43:55 GMT
content-encoding: gzip
server: Netlify
age: 2117
etag: "40d5f29aaf9987cd6cc2e647a2972a5e-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 30138

GET
S 200 jquery.creditCardValidator.js Show response
msdn-lbb-de.netlify.com/js/ 10 KB
3 KB 9ms
8ms Script
application/javascript 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://msdn-lbb-de.netlify.com/js/jquery.creditCardValidator.js

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

2b7557682a283ba78e7db070625e49f99a78e6415b68cf0577de6c07a50008d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003855
date: Mon, 03 Sep 2018 13:43:55 GMT
content-encoding: gzip
server: Netlify
age: 2117
etag: "72a04158a8cd940b36661b61827e4df8-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 2751

GET
S 200 jquery.mask.min.js Show response
msdn-lbb-de.netlify.com/js/ 8 KB
3 KB 9ms
7ms Script
application/javascript 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://msdn-lbb-de.netlify.com/js/jquery.mask.min.js

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

7f81fd50565c42b28d0c131ee55dce21472cfe3ef3f5572e04f279b9898149d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003856
date: Mon, 03 Sep 2018 13:43:55 GMT
content-encoding: gzip
server: Netlify
age: 2117
etag: "2d3e70b1e393f4026507bf6cd89247df-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 3353

GET
S 200 spin.js Show response
msdn-lbb-de.netlify.com/js/ 4 KB
2 KB 9ms
8ms Script
application/javascript 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://msdn-lbb-de.netlify.com/js/spin.js

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

a6a67a3a5760af57c7718d2aa311c497ff1bbdf6481d4d2549b2d3e6835d1206

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003857
date: Mon, 03 Sep 2018 13:43:55 GMT
content-encoding: gzip
server: Netlify
age: 2117
etag: "0bff12956150626412169cd8bd908833-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 2015

GET
S 200 7jFcujT0 Show response
pastebin.com/raw/ 13 KB
4 KB 278ms
236ms Script
text/plain 104.20.208.21
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://pastebin.com/raw/7jFcujT0

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.20.208.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f42cd97e9fdb6bcf074297ad1409c95215123cc81b25ab8da7ce1503612fef7

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 03 Sep 2018 14:19:13 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: public, max-age=1801
cf-ray: 4548d99e4d8abed5-FRA
x-xss-protection: 1; mode=block
expires: Mon, 03 Sep 2018 14:49:14 GMT

GET
S 200 background.gif
msdn-lbb-de.netlify.com/img/ 24 KB
24 KB 11ms
7ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/background.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://msdn-lbb-de.netlify.com/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003861
date: Mon, 03 Sep 2018 13:43:58 GMT
server: Netlify
age: 2115
etag: "d4a028c45fb2641c7d80d620cd95c35c-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 24406

GET
S 200 link.gif
msdn-lbb-de.netlify.com/img/ 67 B
188 B 10ms
6ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/link.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://msdn-lbb-de.netlify.com/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003862
date: Mon, 03 Sep 2018 13:43:58 GMT
server: Netlify
age: 2115
etag: "44facc80ed33c82eb394e853f8aa54c0-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 67

GET
S 200 button.gif
msdn-lbb-de.netlify.com/img/ 67 B
159 B 8ms
7ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/button.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://msdn-lbb-de.netlify.com/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003863
date: Mon, 03 Sep 2018 13:43:58 GMT
server: Netlify
age: 2115
etag: "ebe752670fd8af59238b83bd86cb9793-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 67

GET
S 200 meta.gif
msdn-lbb-de.netlify.com/img/ 81 B
202 B 7ms
7ms Image
image/gif 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://msdn-lbb-de.netlify.com/img/meta.gif

Requested by

Host: landes-service.herokuapp.com
URL: https://landes-service.herokuapp.com/l/bin/dispatch.php?bt_PRELON=1200_LBB

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://msdn-lbb-de.netlify.com/css/lbb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: 9b70d7a0-4311-49f2-a40e-a160c707684f-2003864
date: Mon, 03 Sep 2018 13:43:59 GMT
server: Netlify
age: 2114
etag: "7eb3f514224ae469416a132807cda816-ssl"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 81

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Landesbank Berlin (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			landes-service.herokuapp.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3r3gfpvj124qk4n0j7m28mglb1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

landes-service.herokuapp.com
msdn-lbb-de.netlify.com
pastebin.com
104.20.208.21
178.128.202.129
54.156.188.154
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
2b7557682a283ba78e7db070625e49f99a78e6415b68cf0577de6c07a50008d4
34e7d2a8a056c839bc78c85e05fb8f8a4989a94dd78697b6237ba15f749d0484
4b842affe29896a5f5b945a32191a795b5aaf47a694a05c471c4a25057a8e90b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
7f42cd97e9fdb6bcf074297ad1409c95215123cc81b25ab8da7ce1503612fef7
7f81fd50565c42b28d0c131ee55dce21472cfe3ef3f5572e04f279b9898149d5
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65
a6a67a3a5760af57c7718d2aa311c497ff1bbdf6481d4d2549b2d3e6835d1206
b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a
c160d80e3f1f217dc516c3f72f06eab6a77bf97de8876c76ceb97646c1e08c75
c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182
dba31482c5758be14143eec2611b9bf10a06d7c5563a653b3ae7c75711c1f246
f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186

landes-service.herokuapp.com Open in urlscan Pro 54.156.188.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

90 kBTransfer

173 kBSize

1 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

1 Cookies

Indicators

landes-service.herokuapp.com Open in urlscan Pro
54.156.188.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

90 kB
Transfer

173 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!