vr-kunden.de
Open in
urlscan Pro
2606:4700:3030::ac43:811c
Malicious Activity!
Public Scan
Effective URL: https://vr-kunden.de/volksde/
Submission: On November 24 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on November 17th 2023. Valid for: 3 months.
This is the only time vr-kunden.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online) Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 7 | 2606:4700:303... 2606:4700:3035::6815:169 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 14 | 2606:4700:303... 2606:4700:3030::ac43:811c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
4 | 2a00:1450:400... 2a00:1450:4001:806::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2a00:1450:400... 2a00:1450:4001:813::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | () () | |
28 | 8 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
vr-kunden.de
6 redirects
vr-kunden.de |
557 KB |
7 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
629 KB |
4 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
37 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223 |
11 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 762 |
31 KB |
28 | 5 |
Domain | Requested by | |
---|---|---|
21 | vr-kunden.de |
6 redirects
vr-kunden.de
|
6 | www.gstatic.com |
www.google.com
www.gstatic.com |
4 | www.google.com |
vr-kunden.de
www.gstatic.com www.google.com |
1 | fonts.gstatic.com | |
1 | cdnjs.cloudflare.com |
vr-kunden.de
|
1 | code.jquery.com |
vr-kunden.de
|
28 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
vr-kunden.de GTS CA 1P5 |
2023-11-17 - 2024-02-15 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://vr-kunden.de/volksde/
Frame ID: A0D925675A3D6EE83601CA85AEBB501A
Requests: 19 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdtkwMmAAAAAJZOwz2loDlmGAKlhx7SQn8Y4peG&co=aHR0cHM6Ly92ci1rdW5kZW4uZGU6NDQz&hl=de&v=-QbJqHfGOUB8nuVRLvzFLVed&size=normal&cb=7tr0isu2v99c
Frame ID: 49EAD005776CE6AEEB7CF20A5BACB7C7
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=de&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LdtkwMmAAAAAJZOwz2loDlmGAKlhx7SQn8Y4peG
Frame ID: 31B1DA5FB7F38003712546FDFA49811A
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Unsere Systeme sind zurzeit überlastetPage URL History Show full URLs
- http://vr-kunden.de/volks-de Page URL
-
http://vr-kunden.de/cdn-cgi/phish-bypass?atok=vh7oE6wgilLau_l0zRK5WmppXjlBwjqma5_C3_y38Wg-170081...
HTTP 301
http://vr-kunden.de/volks-de HTTP 301
http://vr-kunden.de/volks-de/ HTTP 301
https://vr-kunden.de/volks-de/ HTTP 302
https://vr-kunden.de/volksde HTTP 301
http://vr-kunden.de/volksde/ HTTP 301
https://vr-kunden.de/volksde/ Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- <div class="[^"]*parbase
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- <div[^>]+class="g-recaptcha"
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://vr-kunden.de/volks-de Page URL
-
http://vr-kunden.de/cdn-cgi/phish-bypass?atok=vh7oE6wgilLau_l0zRK5WmppXjlBwjqma5_C3_y38Wg-1700819398-0-%2Fvolks-de
HTTP 301
http://vr-kunden.de/volks-de HTTP 301
http://vr-kunden.de/volks-de/ HTTP 301
https://vr-kunden.de/volks-de/ HTTP 302
https://vr-kunden.de/volksde HTTP 301
http://vr-kunden.de/volksde/ HTTP 301
https://vr-kunden.de/volksde/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
volks-de
vr-kunden.de/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
vr-kunden.de/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
vr-kunden.de/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
vr-kunden.de/volksde/ Redirect Chain
|
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
omega.css
vr-kunden.de/volksde/css/ |
29 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
aurora.css
vr-kunden.de/volksde/css/ |
671 KB 75 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
nebula.css
vr-kunden.de/volksde/css/ |
2 MB 169 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
important_styles.css
vr-kunden.de/volksde/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
custom_alerts.css
vr-kunden.de/volksde/ |
726 B 726 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Animated.gif
vr-kunden.de/volksde/img/ |
106 KB 106 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
TheBG.jpg
vr-kunden.de/volksde/img/ |
97 KB 97 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SparkasseHead_web_Rg.woff2
vr-kunden.de/volksde/css/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Sparkasse_web_Rg.woff2
vr-kunden.de/volksde/css/fonts/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Sparkasse_web_Bd.woff2
vr-kunden.de/volksde/css/fonts/ |
27 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ |
468 KB 188 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SparkasseHead_web_Rg.woff
vr-kunden.de/volksde/css/fonts/ |
29 KB 30 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame 49EA |
61 KB 35 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 49EA |
55 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 49EA |
468 KB 188 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webworker.js
www.google.com/recaptcha/api2/ Frame 49EA |
102 B 135 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 31B1 |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 31B1 |
55 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 31B1 |
468 KB 188 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 49EA |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 49EA |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 49EA |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 49EA |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online) Sparkasse (Banking)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| documentPictureInPicture function| $ function| jQuery function| myFunction function| CheckRecaptcha function| Reload function| setCookie object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_4778161 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.vr-kunden.de/ | Name: __cf_mw_byp Value: vh7oE6wgilLau_l0zRK5WmppXjlBwjqma5_C3_y38Wg-1700819398-0-/volks-de |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
code.jquery.com
fonts.gstatic.com
vr-kunden.de
www.google.com
www.gstatic.com
2606:4700:3030::ac43:811c
2606:4700:3035::6815:169
2606:4700::6811:180e
2a00:1450:4001:806::2004
2a00:1450:4001:80f::2003
2a00:1450:4001:813::2003
2a04:4e42:400::649
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1f260940d7836d991e9d039ac04cb3e919a39473e2cead8a552f6d7c5afa93e3
2ad94ab7f405aaa2c4b8c1a1de8de74921d720ebea8761e879553174b843e372
3656d49ffb02f6db1f4635116d423bc1d669c79d0645170d06cee8f8a294de82
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
547acff31e762851c76731f8a2e6515efe212f14de4b929faea84f6efbed278e
73089a2d0db696459df65698ed7aa374931c1855792d9d7df44a3ebd406b9af9
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
94b26777111ed2faff5ece63e6079d5b46485775cf62879c0f93f83079c135ec
95c3a12bc98e4f499b5e50b750269c325257a7998833ac5d2279e4de4b8dce9c
983871cac9e719263fcecaa540c4e1597c8ece1805845830ec21fef0e71d9f88
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
a1526819ed10b3c4d9a1f6e956e673b47f295e58ac66e27391777e58e870331d
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b473e61759d63f3cbb0fad7ba4cfd764bfd6e4cd7c4abac5d25aef59415977a0
b8075f0f75d5249042fdeccb99e8b72a32320f92964774acc979ecb6a2132386
dacb847661ec4d4ef564998290ddde9f616bc6cf92565f1cd5b486d419786596
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86
eb7bf02db906592731efaa8338874fde0ebd1135d5ae5307aca6b451871d0e73
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f3706dd9e175fdadc2a564238f1ddc64afea19e67aefd5b922f33040d5f94540
f569780604919083d03615cc8af99dab0aac32ed3e281ef4d833d81f056cd226