urlscan.io logo urlscan.io
SecurityTrails logo

bank-n26.com Open in urlscan Pro
2a00:f940:2:2:1:1:0:164  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://n26-my.com/send/verifid
Effective URL: https://bank-n26.com/myaccount/verified/card/login/
Submission Tags: 7444464
Submission: On February 15 via api from US — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2a00:f940:2:2:1:1:0:164, located in Russian Federation and belongs to AS-REG, RU. The main domain is bank-n26.com.
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on February 14th 2022. Valid for: a year.
This is the only time bank-n26.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: N26 (Banking)

Domain & IP information

IP Address AS Autonomous System
1 185.46.9.68 197695 (AS-REG)
6 2a00:f940:2:2... 197695 (AS-REG)
7 2
Apex Domain
Subdomains		 Transfer
6 bank-n26.com
bank-n26.com
12 KB
1 n26-my.com
n26-my.com
338 B
7 2
Domain Requested by
6 bank-n26.com bank-n26.com
1 n26-my.com
7 2

This site contains no links.

Subject Issuer Validity Valid
www.bank-n26.com
GlobalSign GCC R3 DV TLS CA 2020		 2022-02-14 -
2023-03-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bank-n26.com/myaccount/verified/card/login/
Frame ID: D6649240C302939D0582FB89864A718E
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login — N26

Page URL History Show full URLs

  1. http://n26-my.com/send/verifid Page URL
  2. https://bank-n26.com/myaccount/verified/card/login/ Page URL

Page Statistics

7
Requests

86 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

13 kB
Transfer

62 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://n26-my.com/send/verifid Page URL
  2. https://bank-n26.com/myaccount/verified/card/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
verifid
n26-my.com/send/ 		112 B
338 B 		Document
General
Check archive.org
Download Go to
Full URL
http://n26-my.com/send/verifid
Protocol
HTTP/1.1
Server
185.46.9.68 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
185-46-9-68.cloudvps.regruhosting.ru
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
072c3176c7704b3c214a673dd80ac85a38cf9377a2f2041f2b0a03271596a821

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
it-IT,it;q=0.9

Response headers

Server
nginx/1.18.0 (Ubuntu)
Date
Tue, 15 Feb 2022 07:19:26 GMT
Content-Length
112
Connection
keep-alive
Last-Modified
Mon, 14 Feb 2022 09:52:57 GMT
ETag
"70-5d7f7618f47be"
Accept-Ranges
bytes
Primary Request /
bank-n26.com/myaccount/verified/card/login/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bank-n26.com/myaccount/verified/card/login/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:164 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx / PHP/7.3.33
Resource Hash
a0026d68a9a254f8201a4999765c86fd7fa0bd0307ce9be8010624522edb4328

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
it-IT,it;q=0.9
Referer
http://n26-my.com/

Response headers

server
nginx
date
Tue, 15 Feb 2022 07:19:27 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-powered-by
PHP/7.3.33
content-encoding
gzip
Login_style.css
bank-n26.com/myaccount/verified/card/css/ 		43 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Requested by
Host: bank-n26.com
URL: https://bank-n26.com/myaccount/verified/card/login/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:164 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
2e2a2b4e8f892fd49bce74204cb3fb2de790628e34f4885dd12ea282428be0c9

Request headers

Accept-Language
it-IT,it;q=0.9
Referer
https://bank-n26.com/myaccount/verified/card/login/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 07:19:27 GMT
content-encoding
gzip
last-modified
Mon, 14 Feb 2022 08:54:21 GMT
server
nginx
etag
W/"620a18bd-aabf"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=3888000
expires
Fri, 01 Apr 2022 07:19:27 GMT
Login_form.css
bank-n26.com/myaccount/verified/card/css/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank-n26.com/myaccount/verified/card/css/Login_form.css
Requested by
Host: bank-n26.com
URL: https://bank-n26.com/myaccount/verified/card/login/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:164 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
5894adfa35e4a565b189669629163fa22fd4f0f7cff655d5f53949af775eacc2

Request headers

Accept-Language
it-IT,it;q=0.9
Referer
https://bank-n26.com/myaccount/verified/card/login/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 07:19:27 GMT
content-encoding
gzip
last-modified
Mon, 14 Feb 2022 08:54:21 GMT
server
nginx
etag
W/"620a18bd-3651"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=3888000
expires
Fri, 01 Apr 2022 07:19:27 GMT
GT-America-Standard-Bold.latin.woff2
bank-n26.com/build/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://bank-n26.com/build/fonts/GT-America-Standard-Bold.latin.woff2
Requested by
Host: bank-n26.com
URL: https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:164 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Origin
https://bank-n26.com
Accept-Language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 07:19:27 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=utf-8
GT-America-Standard-Regular.latin.woff2
bank-n26.com/build/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://bank-n26.com/build/fonts/GT-America-Standard-Regular.latin.woff2
Requested by
Host: bank-n26.com
URL: https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:164 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Origin
https://bank-n26.com
Accept-Language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 07:19:27 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=utf-8
GT-America-Standard-Medium.latin.woff2
bank-n26.com/build/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://bank-n26.com/build/fonts/GT-America-Standard-Medium.latin.woff2
Requested by
Host: bank-n26.com
URL: https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f940:2:2:1:1:0:164 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://bank-n26.com/myaccount/verified/card/css/Login_style.css
Origin
https://bank-n26.com
Accept-Language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Tue, 15 Feb 2022 07:19:27 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: N26 (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://bank-n26.com/build/fonts/GT-America-Standard-Medium.latin.woff2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://bank-n26.com/build/fonts/GT-America-Standard-Regular.latin.woff2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://bank-n26.com/build/fonts/GT-America-Standard-Bold.latin.woff2
Message:
Failed to load resource: the server responded with a status of 404 ()