app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io
Open in
urlscan Pro
212.83.186.216
Malicious Activity!
Public Scan
Effective URL: https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/user.php
Submission: On June 08 via api from JP — Scanned from FR
Summary
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.
This is the only time app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 23 | 212.83.186.216 212.83.186.216 | 12876 (Online SAS) (Online SAS) | |
20 | 1 |
ASN12876 (Online SAS, FR)
PTR: 212-83-186-216.rev.poneytelecom.eu
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
cleverapps.io
3 redirects
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io |
854 KB |
20 | 1 |
Domain | Requested by | |
---|---|---|
23 | app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io |
3 redirects
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io
|
20 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sparkasse.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cleverapps.io R3 |
2023-05-26 - 2023-08-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/user.php
Frame ID: 93D7A983BAED3D9D1C3E2AC200291C0E
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Login Online BankingPage URL History Show full URLs
-
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/
HTTP 302
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/?locale=de-CH&authID=3d10eae5545b6dbb561913d6a50... HTTP 302
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/index.php HTTP 302
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/user.php Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- <div class="[^"]*parbase
PHP (Programming Languages) Expand
Detected patterns
- \.php(?:$|\?)
Select2 (JavaScript Libraries) Expand
Detected patterns
- select2(?:\.min|\.full)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- jquery-ui.*\.js
Page Statistics
37 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Sicherheitshinweise
Search URL Search Domain Scan URL
Title: Online-Banking
Search URL Search Domain Scan URL
Title: Girokonto
Search URL Search Domain Scan URL
Title: Tagesgeldkonto
Search URL Search Domain Scan URL
Title: Festgeldkonto
Search URL Search Domain Scan URL
Title: Sparbuch
Search URL Search Domain Scan URL
Title: Aufladbare Kreditkarte
Search URL Search Domain Scan URL
Title: Kreditkarte
Search URL Search Domain Scan URL
Title: Riester-Rente
Search URL Search Domain Scan URL
Title: Kredit
Search URL Search Domain Scan URL
Title: Privatkredit
Search URL Search Domain Scan URL
Title: Dispokredit
Search URL Search Domain Scan URL
Title: Autokredit
Search URL Search Domain Scan URL
Title: Baufinanzierung
Search URL Search Domain Scan URL
Title: Bausparen
Search URL Search Domain Scan URL
Title: Bauspardarlehen
Search URL Search Domain Scan URL
Title: Hypothekendarlehen
Search URL Search Domain Scan URL
Title: Ihre Pläne
Search URL Search Domain Scan URL
Title: GemeinsamAllemGewachsen
Search URL Search Domain Scan URL
Title: Aktuelle Themen
Search URL Search Domain Scan URL
Title: Firmenkunden
Search URL Search Domain Scan URL
Title: Sparen & Anlegen
Search URL Search Domain Scan URL
Title: Altersvorsorge
Search URL Search Domain Scan URL
Title: Versicherungen
Search URL Search Domain Scan URL
Title: Karriere
Search URL Search Domain Scan URL
Title: Filialen A-Z
Search URL Search Domain Scan URL
Title: Geldautomaten A-Z
Search URL Search Domain Scan URL
Title: Finanzlexikon
Search URL Search Domain Scan URL
Title: SEPA
Search URL Search Domain Scan URL
Title: Karte sperren
Search URL Search Domain Scan URL
Title: Sicherungssystem
Search URL Search Domain Scan URL
Title: Sparkassen Apps
Search URL Search Domain Scan URL
Title: Wir ĂĽber uns
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Title: Nutzungshinweise
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/
HTTP 302
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/?locale=de-CH&authID=3d10eae5545b6dbb561913d6a50b8ca5f60d65f6 HTTP 302
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/index.php HTTP 302
https://app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/user.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
user.php
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/ Redirect Chain
|
53 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
new.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
2 MB 207 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opsm.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
541 KB 66 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opttan.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
perf-meter.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
417 B 532 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ospm_custom.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
18 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
38 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.6.0.js
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
395 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.js
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
696 KB 134 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select2.min.css
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
18 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select2.min.js
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
112 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_ini.svg
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/ |
22 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jq.js
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/res/ |
287 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Sparkasse_web_Rg.woff
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/internetfiliale/fonts/ |
41 KB 41 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Sparkasse_web_Bd.woff
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/internetfiliale/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Sparkasse_web_Md.woff
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/internetfiliale/fonts/ |
30 KB 30 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pictos-if.woff
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/internetfiliale/fonts/ |
139 KB 140 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Sparkasse_web_Bd.ttf
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/app/assets/internetfiliale/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
fetch.php
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/panel/ |
1 B 237 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
fetch.php
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/0/32_150834_22795/access_in/panel/ |
1 B 237 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery string| cd1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io/ | Name: PHPSESSID Value: eet8qrmp0bl227f76luccq636u |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app-529c6c5a-9f61-494c-9b80-a6d2e32b5af6.cleverapps.io
212.83.186.216
0c32b7f659cdaa6031d4c6f07cf6f5fc61f06d06773d56a5243fbb3d6905b7c8
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451
22b1c173cbe5e33728889c9ceece95dcf58b6bfe37ea70630ae075ee6744d763
2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a
597f2618a101e8418365e8e5ff37bc46bcf5f8acfad0e49ade3f122028a99e53
5a11af537eb54b3bf625fff3bae8d036821b9fe5e9388050fe7245e5bf2becf3
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
67284df54731fccb0b3c039cbeaab3474c057c5bc95accad964b13ef86eb1c8d
73da975105d70cdf66a4c93aff950b5bee38005576a9b510de0b90aad7e541df
7920a8d19397d7a037019f1271bd247399ea7f8b17d795a9b5675a17abff10f1
7b74bddcb31a1f5225bb43e78cd1d64c4daf7d310b73a1151d4da231f520a966
84798913afc7420e1087ff7c0a0c5b39937ddd430b67bf96561ffbaed9e77b14
8b48ace92c7d48bd32dd054b21552cb99dfe5513a6241f673d5562033a028742
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
be9f62bf09a052caca3c7b447a7d2388e58eb8c5e758d1a7ba156863aed09d36
d4ae335d8c2806be811a8a9c80329a8405421842601bdb0c09baeb2dce951c2a
fb87293d53dc61dc70982eb698a7dbc57cf835cd53967fb1b37bd542b1ac1319