Submitted URL: https://s.free.fr/4cyNYE3X
Effective URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Submission Tags: 6771263
Submission: On September 15 via api from NL

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 104.248.18.129, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is madbk.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 14th 2020. Valid for: 3 months.
This is the only time madbk.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 2a01:e0c:1:15... 12322 (PROXAD)
2 15 104.248.18.129 14061 (DIGITALOC...)
13 2
Apex Domain
Subdomains
Transfer
15 madbk.com
madbk.com
409 KB
1 free.fr
s.free.fr
207 B
13 2
Domain Requested by
15 madbk.com 2 redirects madbk.com
1 s.free.fr 1 redirects
13 2

This site contains no links.

Subject Issuer Validity Valid
madbk.com
Let's Encrypt Authority X3
2020-09-14 -
2020-12-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Frame ID: 57E07AE0F11189E39DE4D75BBFFAA180
Requests: 15 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://s.free.fr/4cyNYE3X HTTP 301
    https://madbk.com/Mein/de/ HTTP 302
    https://madbk.com/Mein/de/q99550/index.php?valid=true&id=90653433 HTTP 302
    https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

428 kB
Transfer

426 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s.free.fr/4cyNYE3X HTTP 301
    https://madbk.com/Mein/de/ HTTP 302
    https://madbk.com/Mein/de/q99550/index.php?valid=true&id=90653433 HTTP 302
    https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 00951124a.php
madbk.com/Mein/de/q99550/
Redirect Chain
  • https://s.free.fr/4cyNYE3X
  • https://madbk.com/Mein/de/
  • https://madbk.com/Mein/de/q99550/index.php?valid=true&id=90653433
  • https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
4 KB
4 KB
Document
General
Full URL
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PHP/7.4.10 PleskLin
Resource Hash
6d7034c4b23c71014d4524d42a270af06f64c159d1aaf7eca911cad912df3c09

Request headers

:method
GET
:authority
madbk.com
:scheme
https
:path
/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=570f90hidqefoprkeh5ugq97t1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
nginx
date
Tue, 15 Sep 2020 21:05:56 GMT
content-type
text/html; charset-UTF-8;charset=UTF-8
x-powered-by
PHP/7.4.10 PleskLin
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache

Redirect headers

status
302
server
nginx
date
Tue, 15 Sep 2020 21:05:56 GMT
content-type
text/html; charset-UTF-8;charset=UTF-8
x-powered-by
PHP/7.4.10 PleskLin
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
location
./00951124a.php?web=succes&local=_&id=89287993
style.css
madbk.com/Mein/de/q99550/layout/css/
207 KB
208 KB
Stylesheet
General
Full URL
https://madbk.com/Mein/de/q99550/layout/css/style.css
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
90ca19861323fd16236c8013b7c9099637c4cee940de5fcc8eea84ce16b45812

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:56 GMT
last-modified
Wed, 02 Sep 2020 02:57:42 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a26-33d27"
content-type
text/css
status
200
accept-ranges
bytes
content-length
212263
style.js
madbk.com/Mein/de/q99550/layout/js/
96 KB
96 KB
Script
General
Full URL
https://madbk.com/Mein/de/q99550/layout/js/style.js
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
a0a2972d1010b99a62268e6b5c416ad75c1f1abbe374ea6123d1b5e332fb544f

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:56 GMT
last-modified
Wed, 02 Sep 2020 02:57:52 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a30-17eff"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
98047
lgm.png
madbk.com/Mein/de/q99550/layout/img/
2 KB
2 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/lgm.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
608d2f0a5a4f3095c311ff0644ee444188e2456b2e3aad4dddd17bfcfcfaf785

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:46 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a2a-6cd"
content-type
image/png
status
200
accept-ranges
bytes
content-length
1741
lg.png
madbk.com/Mein/de/q99550/layout/img/
2 KB
3 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/lg.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
27e18534caa2264f097911adb91ef28ecbd44f836e1930c8529632a99bdac4f4

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:46 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a2a-978"
content-type
image/png
status
200
accept-ranges
bytes
content-length
2424
rech.png
madbk.com/Mein/de/q99550/layout/img/
1 KB
1 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/rech.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
1c6f40e5af1c98c21e718c1eafa10b3675b12f697d0135ed57fffb9260684241

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:48 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a2c-424"
content-type
image/png
status
200
accept-ranges
bytes
content-length
1060
rechm.png
madbk.com/Mein/de/q99550/layout/img/
637 B
806 B
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/rechm.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
fc90065db7f3be398bc681db3c25ccae42a8e96f7188f69ac5d29a161d8eedf9

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
etag
"27d-5ae4bccf5e300"
last-modified
Wed, 02 Sep 2020 02:57:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
image/png
status
200
x-accel-version
0.01
accept-ranges
bytes
content-length
637
pub1.png
madbk.com/Mein/de/q99550/layout/img/
25 KB
26 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/pub1.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
ceea86237e527cf82e51462cce096c8e96f068021beaaa20f79bce194d2a37ac

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:48 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a2c-65f3"
content-type
image/png
status
200
accept-ranges
bytes
content-length
26099
clav.png
madbk.com/Mein/de/q99550/layout/img/
434 B
603 B
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/clav.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
e8c287c04d182e18bb74e7c331163d3455affe18148ddde9f152da5c281f5ab7

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
etag
"1b2-5ae4bccb8da00"
last-modified
Wed, 02 Sep 2020 02:57:44 GMT
server
nginx
x-powered-by
PleskLin
content-type
image/png
status
200
x-accel-version
0.01
accept-ranges
bytes
content-length
434
pss.png
madbk.com/Mein/de/q99550/layout/img/
833 B
1002 B
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/pss.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
7e2cec3fd9b6e9ae8979990be35356161ef1fe6cb29ad3c6db19b8271ac36d66

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
etag
"341-5ae4bccf5e300"
last-modified
Wed, 02 Sep 2020 02:57:48 GMT
server
nginx
x-powered-by
PleskLin
content-type
image/png
status
200
x-accel-version
0.01
accept-ranges
bytes
content-length
833
mend.png
madbk.com/Mein/de/q99550/layout/img/
12 KB
12 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/mend.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
f69e6e5deee9022416eb4794aa37dc6cf592f47ff5664a947163ec7d847ac105

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:46 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a2a-2f65"
content-type
image/png
status
200
accept-ranges
bytes
content-length
12133
foot.png
madbk.com/Mein/de/q99550/layout/img/
26 KB
26 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/foot.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
0af2cb3aee76c2bf434e3fefe3d2883d618ba0a05383118aeebac809166435a8

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:44 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a28-667c"
content-type
image/png
status
200
accept-ranges
bytes
content-length
26236
footm.png
madbk.com/Mein/de/q99550/layout/img/
29 KB
30 KB
Image
General
Full URL
https://madbk.com/Mein/de/q99550/layout/img/footm.png
Requested by
Host: madbk.com
URL: https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.248.18.129 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
9a1bc273bf916f89ee371c6937c0678ce6291e84c521726112a50bdb00701c38

Request headers

Referer
https://madbk.com/Mein/de/q99550/00951124a.php?web=succes&local=_&id=89287993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 21:05:57 GMT
last-modified
Wed, 02 Sep 2020 02:57:46 GMT
server
nginx
x-powered-by
PleskLin
etag
"5f4f0a2a-75ec"
content-type
image/png
status
200
accept-ranges
bytes
content-length
30188
truncated
/
17 KB
17 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171

Request headers

Origin
https://madbk.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8
truncated
/
2 KB
2 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dfb974a480eb34c181c40099fc1ad6714581e1a7ed873be3f9be618563ebd0b7

Request headers

Origin
https://madbk.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DKB (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| preventBack object| Modernizr function| $ function| jQuery function| onReady function| setVisible

1 Cookies

Domain/Path Name / Value
madbk.com/ Name: PHPSESSID
Value: 570f90hidqefoprkeh5ugq97t1