serveice-de-center.xyz
Open in
urlscan Pro
2606:4700:3033::681b:9ad8
Malicious Activity!
Public Scan
Effective URL: https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/rai_login?51136256=51136256&idloginform=71598910638172174...
Submission: On April 23 via manual
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 17th 2020. Valid for: 6 months.
This is the only time serveice-de-center.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Volksbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 192.129.175.98 192.129.175.98 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
2 2 | 2606:4700:303... 2606:4700:3035::6812:392d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 16 | 2606:4700:303... 2606:4700:3033::681b:9ad8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 2 |
ASN54290 (HOSTWINDS, US)
PTR: hwsrv-717733.hostwindsdns.com
service-pruef-service-de.email |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
serveice-de-center.xyz
2 redirects
serveice-de-center.xyz |
182 KB |
2 |
shrt-cut.xyz
2 redirects
shrt-cut.xyz |
832 B |
2 |
service-pruef-service-de.email
2 redirects
service-pruef-service-de.email |
812 B |
1 |
bit.ly
1 redirects
bit.ly |
156 B |
14 | 4 |
Domain | Requested by | |
---|---|---|
16 | serveice-de-center.xyz |
2 redirects
serveice-de-center.xyz
|
2 | shrt-cut.xyz | 2 redirects |
2 | service-pruef-service-de.email | 2 redirects |
1 | bit.ly | 1 redirects |
14 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-04-17 - 2020-10-09 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/rai_login?51136256=51136256&idloginform=71598910638172174594679599693088921468135222562090140144280231142428596195588691303943368564050925349926863989613250249025445488525270537162689025856395891893122021424898491306322234713222262225247794728261584930841225965764941317490522755937958493586346077410101375718376135987031125023082201264056284784027057135627605660151916673870315581364725277628284801106896632623892154930116822602166005116605489450295512736555510262569116761170135212366499826678873994612843281154317720924974687254487860081
Frame ID: 09DA122F9BB0BE02CC0140E07D200226
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e3...
HTTP 301
https://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e3... HTTP 301
https://bit.ly/2VHXOQx HTTP 301
http://shrt-cut.xyz/?u=Wq0E HTTP 301
https://shrt-cut.xyz/?u=Wq0E HTTP 302
https://serveice-de-center.xyz/ Page URL
-
https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs
HTTP 301
http://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ HTTP 301
https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ Page URL
- https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/rai_login?51136256=51136256&idloginfo... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce
HTTP 301
https://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce HTTP 301
https://bit.ly/2VHXOQx HTTP 301
http://shrt-cut.xyz/?u=Wq0E HTTP 301
https://shrt-cut.xyz/?u=Wq0E HTTP 302
https://serveice-de-center.xyz/ Page URL
-
https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs
HTTP 301
http://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ HTTP 301
https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ Page URL
- https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/rai_login?51136256=51136256&idloginform=71598910638172174594679599693088921468135222562090140144280231142428596195588691303943368564050925349926863989613250249025445488525270537162689025856395891893122021424898491306322234713222262225247794728261584930841225965764941317490522755937958493586346077410101375718376135987031125023082201264056284784027057135627605660151916673870315581364725277628284801106896632623892154930116822602166005116605489450295512736555510262569116761170135212366499826678873994612843281154317720924974687254487860081 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce HTTP 301
- https://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce HTTP 301
- https://bit.ly/2VHXOQx HTTP 301
- http://shrt-cut.xyz/?u=Wq0E HTTP 301
- https://shrt-cut.xyz/?u=Wq0E HTTP 302
- https://serveice-de-center.xyz/
- https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs HTTP 301
- http://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ HTTP 301
- https://serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
serveice-de-center.xyz/ Redirect Chain
|
5 B 551 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ Redirect Chain
|
2 B 481 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
rai_login
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ |
11 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
functions.js
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/assets/js/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/assets/js/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
volksbank.css
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/ |
225 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
responsive.css
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/ |
67 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
design.css
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/ |
80 B 209 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hilfe.jpg
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/img/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
array.jpg
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/img/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
up.jpg
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/cssvolks/img/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
329 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timezone.php
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ |
0 298 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timezone.php
serveice-de-center.xyz/banking/5oe0rhmv3kfa741p92z8wdqyniujcs/ |
0 84 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Volksbank (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Aes object| Base64 object| Utf8 string| he12p string| gea string| output string| ctrTxt function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
serveice-de-center.xyz/ | Name: PHPSESSID Value: sfon23i32ittec2rchje9636mt |
|
.serveice-de-center.xyz/ | Name: __cfduid Value: d6b2dc2f4d76485cfb9a4323506b656d11587656160 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
serveice-de-center.xyz
service-pruef-service-de.email
shrt-cut.xyz
192.129.175.98
2606:4700:3033::681b:9ad8
2606:4700:3035::6812:392d
67.199.248.10
222d770aeffae244101da1ae3c157ccf7135a71923703173c35751c3bd18868f
3e1584f5d1eef2d0d815ae6b3c2f6be610c6947d312b6573c02d96dfcdda5c4e
6b6c83b10ba1edba8a632e54b1e677906eeac129725e6c867837374369d929f1
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
861eba7e283d6f7f342fb806e81882126efbc0f0f9da931653bb84f3a770f8ed
867b8aef6ed637992e814f0c2a2631575d461b362e309f21862796216b38219c
8889290353b976b6daa1b18d84d35e3660c3c8382012de18bb127fcee492f44c
a07e35a0a48199eb5cde940517b95ba921bb4a58e173dfea2468c5e4b5578897
c3f57a62d865ac54a3c8e41657b057220e3dea2a94b1662f40e3a470c42919e9
c5e82c983e0c377abdb421f93fe1591c356320b5ffad0a85c562186d29f508ff
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9bcf04a450538a155a0e7dcdcd1c0a3c8ee1d005a930f00a1ef8576afb3560c