![](/screenshots/bbf47a37-ce46-413d-90e6-a0bf5ff55af1.png)
2024-sparkassen-online.xyz
Open in
urlscan Pro
2606:4700:3030::ac43:b569
Malicious Activity!
Public Scan
Effective URL: https://2024-sparkassen-online.xyz/anmeldung.php?starten=hlZXeQEqJdRo6mvNb1H3LB425Oi9Fc&shufflUri?=4lL7RnPH2Kp1FQZtDSgA
Submission: On June 14 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by E5 on June 11th 2024. Valid for: 3 months.
This is the only time 2024-sparkassen-online.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 69.49.245.29 69.49.245.29 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 1 | 172.67.202.45 172.67.202.45 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700:303... 2606:4700:3030::ac43:b569 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 19 | 172.67.181.105 172.67.181.105 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 2 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-245-29.webhostbox.net
us.lhlh3.ru.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
2024-sparkassen-online.xyz
2 redirects
2024-sparkassen-online.xyz |
895 KB |
1 |
haltedurch.xyz
1 redirects
haltedurch.xyz |
514 B |
1 |
ru.com
1 redirects
us.lhlh3.ru.com |
228 B |
19 | 3 |
Domain | Requested by | |
---|---|---|
21 | 2024-sparkassen-online.xyz |
2 redirects
2024-sparkassen-online.xyz
|
1 | haltedurch.xyz | 1 redirects |
1 | us.lhlh3.ru.com | 1 redirects |
19 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
module.foerde-sparkasse.de |
blog.foerde-sparkasse.de |
www.facebook.com |
twitter.com |
www.youtube.com |
www.xing.com |
www.tiktok.com |
termin.foerde-sparkasse.de |
www.studiale.de |
www.sparkassen-shop.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
2024-sparkassen-online.xyz E5 |
2024-06-11 - 2024-09-09 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://2024-sparkassen-online.xyz/anmeldung.php?starten=hlZXeQEqJdRo6mvNb1H3LB425Oi9Fc&shufflUri?=4lL7RnPH2Kp1FQZtDSgA
Frame ID: E0AED7C08DDE2A86A50A0E51E3C6CC9D
Requests: 17 HTTP requests in this frame
Frame:
https://2024-sparkassen-online.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/6aac8896f227/main.js
Frame ID: 3E37005936D863528C6067EE0CB46932
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/bbf47a37-ce46-413d-90e6-a0bf5ff55af1.png)
Page Title
Login Online-Banking | SparkassePage URL History Show full URLs
-
http://us.lhlh3.ru.com/huzrgwehoirfpuzwezigbfhjoweiufgzuwehfiweugfzuwe.php
HTTP 307
https://us.lhlh3.ru.com/huzrgwehoirfpuzwezigbfhjoweiufgzuwehfiweugfzuwe.php HTTP 302
https://haltedurch.xyz/spu HTTP 307
https://2024-sparkassen-online.xyz/?s=h34iceca7wb3x8k6r9ri3tnys1gpeh4y HTTP 302
https://2024-sparkassen-online.xyz/anmeldung.php?starten=hlZXeQEqJdRo6mvNb1H3LB425Oi9Fc&shufflUri?=4lL7RnPH2Kp1... Page URL
Detected technologies
Detected patterns
- <div class="[^"]*parbase
Detected patterns
- \.php(?:$|\?)
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: Podcast
Search URL Search Domain Scan URL
Title: Ihre Sparkasse hautnahBlog der Sparkasse
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: YouTube
Search URL Search Domain Scan URL
Title: Xing
Search URL Search Domain Scan URL
Title: TikTok
Search URL Search Domain Scan URL
Title: Beratungstermin vereinbaren
Search URL Search Domain Scan URL
Title: Studiale
Search URL Search Domain Scan URL
Title: Sparkassen-Shop
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://us.lhlh3.ru.com/huzrgwehoirfpuzwezigbfhjoweiufgzuwehfiweugfzuwe.php
HTTP 307
https://us.lhlh3.ru.com/huzrgwehoirfpuzwezigbfhjoweiufgzuwehfiweugfzuwe.php HTTP 302
https://haltedurch.xyz/spu HTTP 307
https://2024-sparkassen-online.xyz/?s=h34iceca7wb3x8k6r9ri3tnys1gpeh4y HTTP 302
https://2024-sparkassen-online.xyz/anmeldung.php?starten=hlZXeQEqJdRo6mvNb1H3LB425Oi9Fc&shufflUri?=4lL7RnPH2Kp1FQZtDSgA Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 14- https://2024-sparkassen-online.xyz/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://2024-sparkassen-online.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/6aac8896f227/main.js
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
anmeldung.php
2024-sparkassen-online.xyz/ Redirect Chain
|
61 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
internetfiliale.min.36ca8f1e347de7a03a31e002be3843c7.css
2024-sparkassen-online.xyz/src/ |
2 MB 189 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
internetfiliale.min.007ac3aaa8c7e77660499b0a77898638.js
2024-sparkassen-online.xyz/src/ |
612 KB 148 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_ini.svg
2024-sparkassen-online.xyz/src/ |
22 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Bildmarke_S-Sparkasse_72px.svg
2024-sparkassen-online.xyz/src/ |
976 B 887 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1624599692487.png
2024-sparkassen-online.xyz/src/ |
81 KB 82 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1559285204680.jpg
2024-sparkassen-online.xyz/src/ |
49 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tdg
2024-sparkassen-online.xyz/src/ |
45 B 482 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
universal_analytics.min.fce01e1aa1583405fd3c179639d0bd13.js
2024-sparkassen-online.xyz/src/ |
77 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Sparkasse_web_Rg.woff
2024-sparkassen-online.xyz/src/fonts/ |
41 KB 41 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pictos-if.woff
2024-sparkassen-online.xyz/src/fonts/ |
204 KB 205 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Sparkasse_web_Md.woff
2024-sparkassen-online.xyz/src/fonts/ |
30 KB 31 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SparkasseHead_web_Rg.woff
2024-sparkassen-online.xyz/src/fonts/ |
29 KB 30 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Sparkasse_web_Lt.woff
2024-sparkassen-online.xyz/src/fonts/ |
30 KB 30 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Sparkasse_web_Bd.woff
2024-sparkassen-online.xyz/src/fonts/ |
36 KB 36 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
2024-sparkassen-online.xyz/cdn-cgi/challenge-platform/h/g/scripts/jsd/6aac8896f227/ Frame 3E37 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
893a4b0ae97c65cd
2024-sparkassen-online.xyz/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 3E37 |
0 710 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon1x.ico
2024-sparkassen-online.xyz/src/ |
1 KB 689 B |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon2x.png
2024-sparkassen-online.xyz/src/ |
298 B 771 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)37 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 undefined| event object| fence object| sharedStorage object| IF6 function| getQueryParamValue string| IF6_lightbox_closeicon_text function| overlayShow function| overlayClose function| setSessionTimeout function| focusBankingFormularElement function| toggleClassInRows function| SLURI function| moveBContent object| ifLoginHeaderTimer function| refreshClientTimeout function| refreshServerTimeout undefined| startCountdownLayer function| showCountdownLayer function| updateHeaderLoginIfPresent function| tick function| countdownShow function| callBreakHtml object| nbfDatePicker object| nbfTanInput function| selectListBoxItem function| editTeaserRef function| pagenav_statistics_send function| pagenav_statistics function| pagenav_scroll function| pagenav_scroll_window function| $ function| jQuery object| myif object| IF boolean| bcarouselAttached boolean| mkp_switcher2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
2024-sparkassen-online.xyz/ | Name: PHPSESSID Value: br0u8thjqir15k7n73g8a9l90m |
|
.2024-sparkassen-online.xyz/ | Name: cf_clearance Value: 3EaArry6t7pcXmI3Sze66bjWZmsryVYDpL5xDje4CF8-1718367823-1.0.1.1-ctoJ9bmJFVO.dPPne.LIwXz.Ood7_ImixhQ9aHa0zwdRiczYop2LmLfFS7jnxKxswewtZlhz1H0zzCgN3IWGdg |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2024-sparkassen-online.xyz
haltedurch.xyz
us.lhlh3.ru.com
172.67.181.105
172.67.202.45
2606:4700:3030::ac43:b569
69.49.245.29
0953b37758ea0fe97892f833b84425dce3e3dee6419374cf439c373b0a159f2e
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451
25dd114c2f885924740de83597589835df1a394b84b1cf687585790462f95042
2b09bfaae201b4b85471fc79e4890ed850374b3751f3dbda255092b1740c4737
2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a
56e9434317dee79ec08a0e26b77be2e4188fafa982f1e9b91d3103574f131b60
62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4
67284df54731fccb0b3c039cbeaab3474c057c5bc95accad964b13ef86eb1c8d
7771efb0493be3b72af4f72309fbcd3fc797ff5cb68411000809afb7906c2aa2
7bff2bf5fb283195a323aa0994f605e0710397955f82d54d8f4993993a5037d5
8516cb75d22acc9a4c03554aba5684907a0e9879401a5ff6f90733d8b1e0bc82
a9ef9d42dab6b5e3172ec15be7fa5605792b9cd28055eaa9efc29c91eb789da6
d57403a697fb7d9e5090e8958be0325c4ae6d09b72f6d67b9e2a666e6c6be335
e0b6fa06f29b7b1f55548ba583568002f303cc4115033ef6ba3bdc44ea57493e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86
ee88f0851598c363b9b465dd2606efb934c3357aaed3274d0f4a2e6d40b86951
f4e07d2fb57dd99f228e0d5b6e4e7a8d051ae49bb9643d850ac10369a6158e35