![](/screenshots/ea840d3e-17b8-4ba4-9d39-305eaabcac9d.png)
esports.aliancanerd.com
Open in
urlscan Pro
149.56.77.196
Malicious Activity!
Public Scan
Effective URL: https://esports.aliancanerd.com/wp-includes/customize/SPK/app/index?clt_id=41396&defaults=webhelp?srcid=navigation-now&ion=1&esp...
Submission Tags: 7321490
Submission: On October 15 via api from NL — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 16th 2021. Valid for: 3 months.
This is the only time esports.aliancanerd.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 149.56.77.196 149.56.77.196 | 16276 (OVH) (OVH) | |
3 | 78.46.166.187 78.46.166.187 | 24940 (HETZNER-AS) (HETZNER-AS) | |
10 | 3 |
ASN24940 (HETZNER-AS, DE)
PTR: webfonts.sparkasse.de
webfonts.sparkasse.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
aliancanerd.com
esports.aliancanerd.com |
108 KB |
3 |
sparkasse.de
webfonts.sparkasse.de |
84 KB |
10 | 2 |
Domain | Requested by | |
---|---|---|
7 | esports.aliancanerd.com |
esports.aliancanerd.com
|
3 | webfonts.sparkasse.de |
esports.aliancanerd.com
|
10 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
esports.aliancanerd.com cPanel, Inc. Certification Authority |
2021-08-16 - 2021-11-14 |
3 months | crt.sh |
webfonts.sparkasse.de D-TRUST SSL Class 3 CA 1 2009 |
2020-11-23 - 2021-11-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://esports.aliancanerd.com/wp-includes/customize/SPK/app/index?clt_id=41396&defaults=webhelp?srcid=navigation-now&ion=1&espv=2&ie=UTF-8
Frame ID: 882DD0516C791B2C8C11F5408F98D31B
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/ea840d3e-17b8-4ba4-9d39-305eaabcac9d.png)
Page Title
Sparkasse: Produkte und Services | Sparkasse.dePage URL History Show full URLs
- https://esports.aliancanerd.com/wp-includes/customize/SPK/ Page URL
- https://esports.aliancanerd.com/wp-includes/customize/SPK/app/index?clt_id=41396&defaults=webhelp?srcid=navi... Page URL
Detected technologies
Detected patterns
- /etc/designs/
Detected patterns
- /wp-(?:content|includes)/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://esports.aliancanerd.com/wp-includes/customize/SPK/ Page URL
- https://esports.aliancanerd.com/wp-includes/customize/SPK/app/index?clt_id=41396&defaults=webhelp?srcid=navigation-now&ion=1&espv=2&ie=UTF-8 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
esports.aliancanerd.com/wp-includes/customize/SPK/ |
162 B 384 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index
esports.aliancanerd.com/wp-includes/customize/SPK/app/ |
129 KB 33 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clientlibs_vendor.css
esports.aliancanerd.com/wp-includes/customize/SPK/app/etc/designs/shared/ |
29 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clientlibs_standard.css
esports.aliancanerd.com/wp-includes/customize/SPK/app/etc/designs/shared/ |
504 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleco.js
esports.aliancanerd.com/wp-includes/customize/SPK/app/js/ |
1 KB 318 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_ini.svg
esports.aliancanerd.com/wp-includes/customize/SPK/app/content/dam/sparkasse/ |
22 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
484 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sprite-6825441c.svg
esports.aliancanerd.com/wp-includes/customize/SPK/app/etc/designs/shared/static/images/svg/sparkasse/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Sparkasse_web_Bd.woff2
webfonts.sparkasse.de/ |
27 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Sparkasse_web_Rg.woff2
webfonts.sparkasse.de/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Sparkasse_web_It.woff2
webfonts.sparkasse.de/ |
24 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| valZip function| valKonto function| valTan0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
esports.aliancanerd.com
webfonts.sparkasse.de
149.56.77.196
78.46.166.187
2805c3dfeb6ca4c6e35ee20edf47c6f6359dd1ec797ccc5ca04ca566d68fc95c
2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a
547acff31e762851c76731f8a2e6515efe212f14de4b929faea84f6efbed278e
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
8db41fe3da9ce118ee335b135c4f0a1dce27ad3374f3591acf3b28b6528f5653
a1526819ed10b3c4d9a1f6e956e673b47f295e58ac66e27391777e58e870331d
aa2592c60944a9bf14518d44026d270c6b0308c627fef168b22e461020183d32
d1d8b4c6e143faee399a1822e1cb2d2758545b62e7add916d411d6f51b407d53
dacb847661ec4d4ef564998290ddde9f616bc6cf92565f1cd5b486d419786596
df30f557a08fe9d9c3c91e2c5ed3822921f03a4e7c7e218821e35729b9d5f3e7
f5a80c5cf6588a2de7bbeabdebbb6f06dc603b71cc5121a3cbd8cf0745bde3b7