Submitted URL: https://shorty-noono.live/U8N3U
Effective URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Tags: @ipnigh
Submission: On October 09 via api from GB

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions.
The main IP is 2606:4700:30::681c:1916, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is umstellung-service-lbb.xyz.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 9th 2019. Valid for: a year.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 100/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against Landesbank Berlin (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:30:... 13335 (CLOUDFLAR...)
1 12 2606:4700:30:... 13335 (CLOUDFLAR...)
1 89.106.184.28 5630 (WORLDLINE...)
13 3
Domain
Subdomains
Transfer
12 umstellung-service-lbb.xyz
28 KB
1 lbb.de
11 KB
1 shorty-noono.live
392 B
13 3
Domain Requested by
12 umstellung-service-lbb.xyz 1 redirects shorty-noono.live
umstellung-service-lbb.xyz
1 kreditkarten-banking.lbb.de umstellung-service-lbb.xyz
1 shorty-noono.live
13 3

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2
2019-10-02 -
2020-10-01
a year
kreditkarten-banking.lbb.de
DigiCert SHA2 Extended Validation Server CA
2018-02-05 -
2020-02-05
2 years

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
U8N3U
shorty-noono.live
83 B
392 B
Document
General
Full URL
https://shorty-noono.live/U8N3U
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6818:6ad8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b4da1b33ab52dc699908683d31e330c293dbbe6561e2e12f47a718feb3e0f106

Request headers

:method
GET
:authority
shorty-noono.live
:scheme
https
:path
/U8N3U
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
date
Wed, 09 Oct 2019 23:03:21 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d14e51b290508351730821c0e36bf52851570662200; expires=Thu, 08-Oct-20 23:03:20 GMT; path=/; domain=.shorty-noono.live; HttpOnly
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5233fcc3bb45596a-VIE
content-encoding
br
index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD%5ESHOW=do&ref=1200_AMAZON
/lbb
Redirect Chain
  • https://umstellung-service-lbb.xyz/
  • https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
7 KB
2 KB
Document
General
Full URL
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Requested by
Host: shorty-noono.live
URL: https://shorty-noono.live/U8N3U
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
32d34d85dceff6d163089a8aa786eca44e342ab7c2956482a55e4e981e98875b

Request headers

:method
GET
:authority
umstellung-service-lbb.xyz
:scheme
https
:path
/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://shorty-noono.live/U8N3U
accept-encoding
gzip, deflate, br
cookie
__cfduid=d3b25162cad73d42b7d9065d8895d81d91570662201
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://shorty-noono.live/U8N3U

Response headers

status
200
date
Wed, 09 Oct 2019 23:03:21 GMT
content-type
text/html; charset=UTF-8
set-cookie
PHPSESSID=u9gj1oj4iud21ah1jvg5asqbg3; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5233fcc6281ecb98-VIE
content-encoding
br

Redirect headers

status
302
date
Wed, 09 Oct 2019 23:03:21 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d3b25162cad73d42b7d9065d8895d81d91570662201; expires=Thu, 08-Oct-20 23:03:21 GMT; path=/; domain=.umstellung-service-lbb.xyz; HttpOnly
location
lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5233fcc5af2bcb98-VIE
lbb.css
/lbb/css
8 KB
1 KB
Stylesheet
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/lbb.css
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8e61f018fba093a659badcd86f283bbad9f4a6532b3b8c130587159329286dc

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
W/"1e24-586e17f3cae00-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
5233fcc6c94ecb98-VIE
expires
Thu, 10 Oct 2019 03:03:21 GMT
Titellogo1.gif
/lbb/css
43 B
102 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/Titellogo1.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:46 GMT
server
cloudflare
age
5731
etag
"2b-586e17f5b3280"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6c94fcb98-VIE
content-length
43
expires
Thu, 10 Oct 2019 03:03:21 GMT
LBB_login_links.gif
/lbb/css
59 B
136 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/LBB_login_links.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34e7d2a8a056c839bc78c85e05fb8f8a4989a94dd78697b6237ba15f749d0484

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:46 GMT
server
cloudflare
age
5731
etag
"3b-586e17f5b3280"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6c950cb98-VIE
content-length
59
expires
Thu, 10 Oct 2019 03:03:21 GMT
metaarea.gif
/lbb/css
49 B
149 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/metaarea.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
"31-586e17f3cae00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6c952cb98-VIE
content-length
49
expires
Thu, 10 Oct 2019 03:03:21 GMT
Banklogo.gif
/lbb/css
43 B
205 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/Banklogo.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:46 GMT
server
cloudflare
age
5731
etag
"2b-586e17f5b3280"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6c953cb98-VIE
content-length
43
expires
Thu, 10 Oct 2019 03:03:21 GMT
LBB_login_rechts.gif
kreditkarten-banking.lbb.de/cust_img/berliner_spk
11 KB
11 KB
Image
General
Full URL
https://kreditkarten-banking.lbb.de/cust_img/berliner_spk/LBB_login_rechts.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
89.106.184.28 Aachen, Germany, ASN5630 (WORLDLINE-GERMANY Atos Worldline SAS, DE),
Reverse DNS
Software
/
Resource Hash
dba31482c5758be14143eec2611b9bf10a06d7c5563a653b3ae7c75711c1f246

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 09 Oct 2019 23:03:21 GMT
X-Pad
avoid browser bug
Last-Modified
Mon, 30 Sep 2019 13:50:08 GMT
ETag
"2a04-593c5838f926b"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=10, max=100
Content-Length
10756
navlinks.gif
/lbb/css
49 B
108 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/navlinks.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
"31-586e17f3cae00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6c95ccb98-VIE
content-length
49
expires
Thu, 10 Oct 2019 03:03:21 GMT
background.gif
/lbb/css
24 KB
24 KB
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/background.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7808138a4b8a00e35e54c062201202e9e5523a2af47b5f3f480a89929279182

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/css/lbb.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
"5f56-586e17f3cae00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6e9a9cb98-VIE
content-length
24406
expires
Thu, 10 Oct 2019 03:03:21 GMT
meta.gif
/lbb/css
81 B
158 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/meta.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8db428a0d53deeaa8ff46ba403fb22afcb0e9ef754fafd1aee08957f58c856a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/css/lbb.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
"51-586e17f3cae00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6e9aacb98-VIE
content-length
81
expires
Thu, 10 Oct 2019 03:03:21 GMT
button.gif
/lbb/css
67 B
144 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/button.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
918eabacb055e7cf2ef8c1a2006f910874383910fb86b6457d26fece62d7aa65

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/css/lbb.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
"43-586e17f3cae00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6e9adcb98-VIE
content-length
67
expires
Thu, 10 Oct 2019 03:03:21 GMT
link.gif
/lbb/css
67 B
126 B
Image
General
Full URL
https://umstellung-service-lbb.xyz/lbb/css/link.gif
Requested by
Host: umstellung-service-lbb.xyz
URL: https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1916 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8ff5491f83963d4027ce74232bfabbcb7a089e5a8331282913ccb377d7a1186

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://umstellung-service-lbb.xyz/lbb/css/lbb.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 09 Oct 2019 23:03:21 GMT
cf-cache-status
HIT
last-modified
Fri, 19 Apr 2019 12:45:44 GMT
server
cloudflare
age
5731
etag
"43-586e17f3cae00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
5233fcc6e9afcb98-VIE
content-length
67
expires
Thu, 10 Oct 2019 03:03:21 GMT

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 1
  • https://umstellung-service-lbb.xyz/
  • https://umstellung-service-lbb.xyz/lbb/index.php??dispatch.do;jsessionid=0001mWRnz9pZNyrx8T5Rx9pQfUg:-GO4DCN?rai=0&bt_ACTMD^SHOW=do&ref=1200_AMAZON

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: Landesbank Berlin (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

2 Cookies

Domain/Path Name / Value
umstellung-service-lbb.xyz/ Name: PHPSESSID
Value: u9gj1oj4iud21ah1jvg5asqbg3
.umstellung-service-lbb.xyz/ Name: __cfduid
Value: d3b25162cad73d42b7d9065d8895d81d91570662201