kuvajmosrcem.com Open in urlscan Pro
185.119.88.139 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/
Submission: On May 30 via manual (May 30th 2024, 5:31:15 pm UTC) from US — Scanned from DE

Summary HTTP 6 Redirects Links 36 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 185.119.88.139, located in Belgrade, Serbia and belongs to UNITED, RS. The main domain is kuvajmosrcem.com.
TLS certificate: Issued by R3 on April 4th 2024. Valid for: 3 months.

This is the only time kuvajmosrcem.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 7	185.119.88.139 185.119.88.139		207604 (UNITED) (UNITED)
6	2

7 185.119.88.139 (Belgrade, Serbia) 1 redirects

ASN207604 (UNITED, RS)
PTR: s9.unlimited.rs

kuvajmosrcem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	kuvajmosrcem.com 1 redirects kuvajmosrcem.com	30 KB
6	1

	Domain	Requested by
7	kuvajmosrcem.com	1 redirects kuvajmosrcem.com
6	1

This site contains links to these domains. Also see Links.

Domain
www.sparkasse.de

Subject Issuer	Validity	Valid
kuvajmosrcem.com R3	`2024-04-04` - `2024-07-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/
Frame ID: 9E93555CFD5D1420C78625697495039B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sparkasse Reaktivierung

Page URL History Show full URLs

https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346 HTTP 301
https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Page URL

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

30 kB
Transfer

89 kB
Size

0
Cookies

36 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/online-banking.html
Title: Online-Banking

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/girokonto.html
Title: Girokonto

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/tagesgeldkonto.html
Title: Tagesgeldkonto

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/sparen-anlegen/festgeldkonto.html
Title: Festgeldkonto

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/sparen-anlegen/sparbuch.html
Title: Sparbuch

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/karten/aufladbare-kreditkarte.html
Title: Aufladbare Kreditkarte

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/karten/kreditkarte.html
Title: Kreditkarte

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/altersvorsorge/riester-rente.html
Title: Riester-Rente

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen.html
Title: Kredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/privatkredit.html
Title: Privatkredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/dispokredit.html
Title: Dispokredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/autokredit.html
Title: Autokredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/baufinanzierung.html
Title: Baufinanzierung

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/bausparen-bausparvertrag.html
Title: Bausparen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/bauspardarlehen.html
Title: Bauspardarlehen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/hypothekendarlehen.html
Title: Hypothekendarlehen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/themen.html
Title: Ihre Pläne

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/gemeinsamallemgewachsen.html
Title: GemeinsamAllemGewachsen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/geld-leichter-verstehen.html
Title: Geld einfach verstehen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/sicherheit-im-internet.html
Title: Sicherheit im Internet

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/firmenkunden.html
Title: Firmenkunden

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/sparen-anlegen.html
Title: Sparen & Anlegen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/altersvorsorge.html
Title: Altersvorsorge

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/versicherungen.html
Title: Versicherungen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/karriere.html
Title: Karriere

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/filialen.html
Title: Filialen A-Z

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/geldautomaten.html
Title: Geldautomaten A-Z

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/finanzlexikon.html
Title: Finanzlexikon

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/sepa.html
Title: SEPA

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/karte-sperren.html
Title: Karte sperren

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/infocenter/sicherungssystem.html
Title: Sicherungssystem

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/sparkassen-apps.html
Title: Sparkassen Apps

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/wir-ueber-uns.html
Title: Wir über uns

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/datenschutz.html
Title: Datenschutz

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/nutzungshinweise.html
Title: Nutzungshinweise

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346 HTTP 301
https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Redirect Chain https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346 https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/	57 KB 3 KB	18ms 17ms	Document text/html	185.119.88.139 UNITED
General Check archive.org Show headers Download Go to Full URL https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.119.88.139 Belgrade, Serbia, ASN207604 (UNITED, RS), Reverse DNS s9.unlimited.rs Software LiteSpeed / Resource Hash `4bdf313989f79ea44c062ce2d14025b30cbf565be74f04ee26b6c053074be697` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes content-encoding br content-length 3429 content-type text/html date Thu, 30 May 2024 17:31:11 GMT last-modified Mon, 14 Jun 2021 21:09:34 GMT server LiteSpeed vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 707 content-type text/html date Thu, 30 May 2024 17:31:11 GMT location https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ server LiteSpeed
GET H2	200	style.css kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/	7 KB 1 KB	18ms 17ms	Stylesheet text/css	185.119.88.139 UNITED
General Check archive.org Show headers Download Go to Full URL https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/style.css Requested by Host: kuvajmosrcem.com URL: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.119.88.139 Belgrade, Serbia, ASN207604 (UNITED, RS), Reverse DNS s9.unlimited.rs Software LiteSpeed / Resource Hash `116412bd999158689026a0461605c642115ce78466ceb6c92b55319604d66f3b` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 30 May 2024 17:31:11 GMT content-encoding br last-modified Mon, 14 Jun 2021 21:10:04 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 995 expires Thu, 06 Jun 2024 17:31:11 GMT
GET H2	200	Topbannerlogo.png kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/	12 KB 12 KB	33ms 32ms	Image image/png	185.119.88.139 UNITED
General Check archive.org Show headers Download Go to Show image Full URL https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/Topbannerlogo.png Requested by Host: kuvajmosrcem.com URL: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.119.88.139 Belgrade, Serbia, ASN207604 (UNITED, RS), Reverse DNS s9.unlimited.rs Software LiteSpeed / Resource Hash `84ca80f7f566af23b2d22bc000944f98cee6bbb00843ad13fc30f7f72b2d732a` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 30 May 2024 17:31:11 GMT last-modified Mon, 14 Jun 2021 21:10:53 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 12646 expires Thu, 06 Jun 2024 17:31:11 GMT
GET H2	200	DE.PNG kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/	1 KB 1 KB	35ms 34ms	Image image/png	185.119.88.139 UNITED
General Check archive.org Show headers Download Go to Show image Full URL https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/DE.PNG Requested by Host: kuvajmosrcem.com URL: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.119.88.139 Belgrade, Serbia, ASN207604 (UNITED, RS), Reverse DNS s9.unlimited.rs Software LiteSpeed / Resource Hash `e6ef822dbf57955e1060eef9e9d7fbc72e638585e64b14d17f7b403c51dbfdf5` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 30 May 2024 17:31:11 GMT last-modified Mon, 14 Jun 2021 21:10:53 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 1048 expires Thu, 06 Jun 2024 17:31:11 GMT
GET H2	200	Schloss.PNG kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/	381 B 412 B	33ms 33ms	Image image/png	185.119.88.139 UNITED
General Check archive.org Show headers Download Go to Show image Full URL https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/Schloss.PNG Requested by Host: kuvajmosrcem.com URL: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.119.88.139 Belgrade, Serbia, ASN207604 (UNITED, RS), Reverse DNS s9.unlimited.rs Software LiteSpeed / Resource Hash `2d42908cc99e7a40113374446f52be5e2cc6ed50ce868337867653bd63859fda` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 30 May 2024 17:31:11 GMT last-modified Mon, 14 Jun 2021 21:10:53 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 381 expires Thu, 06 Jun 2024 17:31:11 GMT
GET DATA	200 OK	truncated /	266 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3	200	logo.png kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/	11 KB 11 KB	20ms 19ms	Other image/png	185.119.88.139 UNITED
General Check archive.org Show headers Download Go to Full URL https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/Bilder/logo.png Protocol H3 Security QUIC, , AES_128_GCM Server 185.119.88.139 Belgrade, Serbia, ASN207604 (UNITED, RS), Reverse DNS s9.unlimited.rs Software LiteSpeed / Resource Hash `aba99f83bf08f8e4228a950a58ac5aca58d345f38b1453713e6cd54d8e47bf51` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 30 May 2024 17:31:11 GMT last-modified Mon, 14 Jun 2021 21:10:53 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 11288 expires Thu, 06 Jun 2024 17:31:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://kuvajmosrcem.com/ksk/sparkasse/de/login/ID456784358435453465346/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kuvajmosrcem.com
185.119.88.139
116412bd999158689026a0461605c642115ce78466ceb6c92b55319604d66f3b
2d42908cc99e7a40113374446f52be5e2cc6ed50ce868337867653bd63859fda
4bdf313989f79ea44c062ce2d14025b30cbf565be74f04ee26b6c053074be697
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
84ca80f7f566af23b2d22bc000944f98cee6bbb00843ad13fc30f7f72b2d732a
aba99f83bf08f8e4228a950a58ac5aca58d345f38b1453713e6cd54d8e47bf51
e6ef822dbf57955e1060eef9e9d7fbc72e638585e64b14d17f7b403c51dbfdf5

kuvajmosrcem.com Open in urlscan Pro 185.119.88.139 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

30 kBTransfer

89 kBSize

0 Cookies

36 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

kuvajmosrcem.com Open in urlscan Pro
185.119.88.139 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

30 kB
Transfer

89 kB
Size

0
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!