169.239.129.24
Open in
urlscan Pro
169.239.129.24
Malicious Activity!
Public Scan
URL:
http://169.239.129.24/upload.php
Submission: On September 22 via automatic, source openphish — Scanned from DE
Submission: On September 22 via automatic, source openphish — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 2 domains to perform 15 HTTP transactions.
The main IP is 169.239.129.24, located in
Cape Town, South Africa and
belongs to ZAPPIE-HOST-AS Zappie Host, US.
The main domain is 169.239.129.24.
This is the only time 169.239.129.24 was scanned on urlscan.io!
This is the only time 169.239.129.24 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Deutsche Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 169.239.129.24 169.239.129.24 | 61138 (ZAPPIE-HO...) (ZAPPIE-HOST-AS Zappie Host) | |
| 11 | 129.35.230.2 129.35.230.2 | 8373 (DEUBA-NET...) (DEUBA-NET Germany) | |
| 1 | 69.16.175.10 69.16.175.10 | 33438 (HIGHWINDS2) (HIGHWINDS2) | |
| 15 | 4 |
3
169.239.129.24
(Cape Town, South Africa)
ASN61138 (ZAPPIE-HOST-AS Zappie Host, US)
PTR: rns.za.zappiehost.com
ASN61138 (ZAPPIE-HOST-AS Zappie Host, US)
PTR: rns.za.zappiehost.com
| 169.239.129.24 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
deutsche-bank.de
meine.deutsche-bank.de |
|
| 1 |
jquery.com
code.jquery.com |
30 KB |
| 15 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | meine.deutsche-bank.de |
169.239.129.24
|
| 1 | code.jquery.com |
169.239.129.24
|
| 15 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| wob.deutsche-bank.de |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| meine.deutsche-bank.de DigiCert EV RSA CA G2 |
2021-07-27 - 2022-07-27 |
a year | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://169.239.129.24/upload.php
Frame ID: E210F80429D4E59AF12C08A9F4E872E7
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Onlinebanking und Brokerage der Deutschen BankDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Prototype
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://wob.deutsche-bank.de/trxm/help/pu_help_ovv_impressum.html
Title: Impressum
Title: Impressum
Search URL Search Domain Scan URL
URL: https://wob.deutsche-bank.de/trxm/help/pu_help_ovv_rechtlhinweis_dbpbc.html
Title: Rechtliche Hinweise
Title: Rechtliche Hinweise
Search URL Search Domain Scan URL
URL: https://wob.deutsche-bank.de/trxm/help/pu_help_ovv_datenschutz.html
Title: Datenschutz
Title: Datenschutz
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
upload.php
169.239.129.24/ |
67 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prototype.js
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/default/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global.js
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/default/javascript/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
native-shim.js
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/common/javascript/webcomponents/src/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
custom-elements.min.js
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/common/javascript/webcomponents/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cms_snippets.es5.js
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/common/javascript/cms-snippets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
db-eccs-pws-pwcc-clientlib-trxm.css
meine.deutsche-bank.de/trxmcontent/20.41.0.0_PR43-389fc68ed47/global/default/css/screen/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
base.css
169.239.129.24/ |
347 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_db.gif
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/default/images/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
db-eccs-pws-pwcc-clientlib-trxm.css
meine.deutsche-bank.de/trxmcontent/20.41.0.0_PR43-389fc68ed47/global/default/css/screen/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
print.css
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/default/css/print/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
24 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg_headerContainer.svg
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/default/images/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bt_primary_default.png
meine.deutsche-bank.de/trxmcontent/20.43.0.1_PR43-29cc9d74729/global/default/images/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
UniversDeutscheBankW01-Reg.woff
169.239.129.24/webfonts/ |
48 KB 48 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Deutsche Bank (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery boolean| __disableDappDetectionInsertion undefined| f1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| 169.239.129.24/ | Name: PHPSESSID Value: 7ukgnlfu8n1mtp2sa2ugekvshe |
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
meine.deutsche-bank.de
129.35.230.2
169.239.129.24
69.16.175.10
0279c681fd5c7a64385abe65576ac9e5655c42eb2ec98f37452a946437ef3df0
2ba26851e7dec84005b1d59e35ec70cf76c984ee26570a10db9915a300ec9345
4713858ba9e8292ca443bde63df83f9d13b3eab4c92e7455a2983de7d2e4165c
61115cd58d9c3d5fef2d0c4b944df3cf7d565f17c35f58d84238095b1226bb5c
a53adc5c73d77a8807d2f7545602a7058ef5cdfe1ff3f16216ead448475d15ab
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f60f1321afad59b79450a48b8ce66d6a1e29a324968183d56b83776c735200c1
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d