spk-at-legitimierung.com
Open in
urlscan Pro
5.188.42.123
Malicious Activity!
Public Scan
Effective URL: https://spk-at-legitimierung.com/9292UPDATE
Submission: On February 01 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on January 30th 2023. Valid for: 3 months.
This is the only time spk-at-legitimierung.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 193.0.160.129 193.0.160.129 | 54312 (ROCKETFUEL) (ROCKETFUEL) | |
1 1 | 2606:4700:20:... 2606:4700:20::6819:ea35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 5.188.42.123 5.188.42.123 | 49505 (SELECTEL) (SELECTEL) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 3 |
ASN49505 (SELECTEL, RU)
PTR: casitmap.site
spk-at-legitimierung.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
spk-at-legitimierung.com
spk-at-legitimierung.com |
90 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 198 |
28 KB |
1 |
is.gd
1 redirects
is.gd — Cisco Umbrella Rank: 60095 |
145 B |
1 |
rfihub.com
1 redirects
p.rfihub.com — Cisco Umbrella Rank: 741 |
558 B |
6 | 4 |
Domain | Requested by | |
---|---|---|
5 | spk-at-legitimierung.com |
spk-at-legitimierung.com
|
1 | cdnjs.cloudflare.com |
spk-at-legitimierung.com
|
1 | is.gd | 1 redirects |
1 | p.rfihub.com | 1 redirects |
6 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
spk-at-legitimierung.com R3 |
2023-01-30 - 2023-04-30 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://spk-at-legitimierung.com/9292UPDATE
Frame ID: 379D290907D3482782B5D3416214ECDB
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Erste Bank und Sparkassen LoginPage URL History Show full URLs
-
https://p.rfihub.com/cm?forward=https:///is.gd:00443/bf1d0M?06616517109886599\
HTTP 302
https://is.gd/bf1d0M?06616517109886599\ HTTP 301
https://spk-at-legitimierung.com/9292UPDATE Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://p.rfihub.com/cm?forward=https:///is.gd:00443/bf1d0M?06616517109886599\
HTTP 302
https://is.gd/bf1d0M?06616517109886599\ HTTP 301
https://spk-at-legitimierung.com/9292UPDATE Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
9292UPDATE
spk-at-legitimierung.com/ Redirect Chain
|
190 KB 90 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
915 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular-webfont.woff
spk-at-legitimierung.com/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
729 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Semibold-webfont.woff
spk-at-legitimierung.com/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
49 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.3/ |
88 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular-webfont.ttf
spk-at-legitimierung.com/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Semibold-webfont.ttf
spk-at-legitimierung.com/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.rfihub.com/ | Name: ruds Value: H4sIAAAAAAAA_-MSNjU0NjExNTUxMrA0srQEciwNhfgMdTOKHS2MDP2yPIqyywEsFnhBJQAAAA |
|
.rfihub.com/ | Name: rud Value: H4sIAAAAAAAA_-MSNjU0NjExNTUxMrA0srQEciwNhfgMdTOKHS2MDP2yPIqyywEsFnhBJQAAAA |
|
spk-at-legitimierung.com/ | Name: PHPSESSID Value: j3glsorh02sb8qr20j9mqq1p67 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
is.gd
p.rfihub.com
spk-at-legitimierung.com
193.0.160.129
2606:4700:20::6819:ea35
2606:4700::6811:190e
5.188.42.123
04cf169a10f64a9ce6b5650e37e047651690b18b238e1f431636aa292d6fb600
48c24fd8fb19b02949a64918eb768e58dbe70210ad7de1f7f78dfc0052dfde82
7f3bb00172f8cdbfc801edcf44061ca42f9dc87223db9fe3638355c114daf455
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
a88cbcdb7b61a4d601f752ccd6cffdc2803bbde6becfe6626ad3c7f1070b492f
b0f484443bd01c61cebbfb1c3abe4a253e3a0c314150025521712fefc3284224
b8bb52fdbcbdc0b034daee432a3eb2f3232cb0ba16a3eb527bae55cdbc4aaa96
fcefa276f4f9af1acd48ef626f2c53be9990253a7498d22bae50689baa834af7