sparkasseid.info Open in urlscan Pro
185.185.69.181 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sparkasseid.info/
Effective URL:
https://sparkasseid.info/
Submission: On November 06 via api (November 6th 2024, 1:14:49 pm UTC) from US — Scanned from DE

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 23 HTTP transactions. The main IP is 185.185.69.181, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is sparkasseid.info.
TLS certificate: Issued by R10 on November 6th 2024. Valid for: 3 months.

This is the only time sparkasseid.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

	IP Address	AS Autonomous System
16	185.185.69.181 185.185.69.181	35278 (SPRINTHOST) (SPRINTHOST)
1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
3	142.250.185.68 142.250.185.68	15169 (GOOGLE) (GOOGLE)
1	216.58.212.163 216.58.212.163	15169 (GOOGLE) (GOOGLE)
1	104.21.20.107 104.21.20.107	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	6

16 185.185.69.181 (Russian Federation)

ASN35278 (SPRINTHOST, RU)

sparkasseid.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

anal-lytics.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.68 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.20.107 (None, )

ASN13335 (CLOUDFLARENET, US)

api.inetstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	sparkasseid.info sparkasseid.info	931 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	969 B
1	inetstatic.com api.inetstatic.com	861 B
1	gstatic.com www.gstatic.com	217 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 791	31 KB
1	anal-lytics.site anal-lytics.site	637 B
23	6

	Domain	Requested by
16	sparkasseid.info	sparkasseid.info
3	www.google.com	sparkasseid.info www.gstatic.com
1	api.inetstatic.com	sparkasseid.info
1	www.gstatic.com	www.google.com
1	code.jquery.com	sparkasseid.info
1	anal-lytics.site	sparkasseid.info
23	6

This site contains no links.

Subject Issuer	Validity	Valid
sparkasseid.info R10	`2024-11-06` - `2025-02-04`	3 months	crt.sh
anal-lytics.site WE1	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
inetstatic.com WE1	`2024-09-25` - `2024-12-24`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://sparkasseid.info/
Frame ID: 56C08BB002FC7EF5E4B355ED33C977C1
Requests: 21 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2&co=aHR0cHM6Ly9zcGFya2Fzc2VpZC5pbmZvOjQ0Mw..&hl=de&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=1iseue7473rv
Frame ID: D443D848A91D5D31E85F4E997DBA6426
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de&v=-ZG7BC9TxCVEbzIO2m429usb&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2
Frame ID: DD85F8EC1D5372CBB4230D13335EBA11
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Verifizieren Sie Ihre Echtheit

Page URL History Show full URLs

http://sparkasseid.info/ HTTP 307
https://sparkasseid.info/ Page URL

Detected technologies

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"
/recaptcha/api\.js

Page Statistics

23
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

1182 kB
Transfer

4309 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sparkasseid.info/ HTTP 307
https://sparkasseid.info/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sparkasseid.info/
Redirect Chain

http://sparkasseid.info/
https://sparkasseid.info/

8 KB
3 KB

216ms
78ms

Document
text/html

185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PHP/7.4.33 PleskLin
Resource Hash: 9b430d03b29fd0cee8fd51c4ce9c09ece8e013a1403900e72e11019bad53e8e3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 2449
content-type: text/html; charset=UTF-8
date: Wed, 06 Nov 2024 13:28:05 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/7.4.33 PleskLin

Redirect headers

Location: https://sparkasseid.info/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 erv1vOpbgRElhRgF Show response
anal-lytics.site/pixel/ 0
637 B 805ms
509ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://anal-lytics.site/pixel/erv1vOpbgRElhRgF
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33, PleskLin
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

cache-control: max-age=300
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WGCb2O6XWHmH1s%2BdXY7H3IZGkZp2VyUIuS1nrYGsfnM2FmfXo%2BQtcYdLhjvwRWS8VM%2FnKQNh1mQfUptqenIlsMKZnRLoWA2uG7YMdGIz4ZwQ%2FW2wd8kQ1cFQXa7tZs5xLN4egjGiCAdYLuZ%2BXUWI"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de559230a8ac943-IAD
expires: Wed, 06 Nov 2024 13:33:06 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=92585&sent=9&recv=13&lost=0&retrans=0&sent_bytes=3928&recv_bytes=2179&delivery_rate=41195&cwnd=35&unsent_bytes=0&cid=c1b895b16b5b43e4&ts=591&x=0"
content-length: 0
date: Wed, 06 Nov 2024 13:14:43 GMT
content-type: application/javascript
x-powered-by: PHP/7.4.33, PleskLin
server: cloudflare

GET
H2 200 app.css
sparkasseid.info/css/ 2 MB
153 KB 165ms
163ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/app.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: ee3a3ead6613706b3ed572ffc5dfda04d0dbd23ee3ca531b0667bce2fc13cf66

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1552-1aa935"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:22 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 opsm.css
sparkasseid.info/css/ 520 KB
59 KB 257ms
256ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/opsm.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 63e72211b14fd60bbd0297df351621ff058717b129732429ce12c0db6d19144b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1552-821ce"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:22 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 opttan.css
sparkasseid.info/css/ 4 KB
1 KB 303ms
302ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/opttan.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: c6ce7c8d3cdd2175bfb851d5fb45fe42b004ce4832f2b950db31b8fe5cf9cf6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1550-11f8"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 perf-meter.css
sparkasseid.info/css/ 398 B
438 B 304ms
303ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/perf-meter.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: f008c09173b9230f184fdbcf0fcbf3c4fc8daf1bea6c41b3614f5a3a11e9d376

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

x-powered-by: PleskLin
content-encoding: gzip
etag: "18e-5eb186df3f400-gzip"
x-accel-version: 0.01
accept-ranges: bytes
content-length: 231
date: Wed, 06 Nov 2024 13:28:06 GMT
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 ospm_custom.css
sparkasseid.info/css/ 18 KB
3 KB 304ms
302ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/ospm_custom.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d8ad9ac7b82f1b3feb913e78d5177210c73131d217d6db6e7a18c6fb91e582e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1550-474a"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-ui.css
sparkasseid.info/css/ 35 KB
8 KB 305ms
304ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/jquery-ui.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 5af098721b219c4801711bad963757a6cbac2aa2d4cfcde9ee7aec943219c066

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1550-8d18"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-3.6.0.js Show response
sparkasseid.info/js/ 282 KB
78 KB 307ms
306ms Script
application/javascript 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/js/jquery-3.6.0.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1550-46744"
content-type: application/javascript
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-ui.js Show response
sparkasseid.info/js/ 517 KB
113 KB 310ms
309ms Script
application/javascript 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/js/jquery-ui.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: b0fb363c54d6747d3609153c3cf96424e27e806162de5f7083e7fc37fd540833

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b155a-8158c"
content-type: application/javascript
last-modified: Sat, 15 Oct 2022 20:17:30 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 select2.min.css
sparkasseid.info/css/ 16 KB
2 KB 305ms
305ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/select2.min.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b1550-3f88"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 select2.min.js Show response
sparkasseid.info/js/ 72 KB
18 KB 344ms
343ms Script
application/javascript 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/js/select2.min.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d7bf5175d05e81bec066f1e5b222d0ca71f1f68311123a9c28271f4be0e01e55

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:06 GMT
etag: W/"634b155a-11efb"
content-type: application/javascript
last-modified: Sat, 15 Oct 2022 20:17:30 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-3.6.1.min.js Show response
code.jquery.com/ 88 KB
31 KB 51ms
7ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.1.min.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15e40"
age: 890868
x-cache: HIT, HIT
date: Wed, 06 Nov 2024 13:14:42 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-cache-hits: 2, 6679
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-served-by: cache-lga13629-LGA, cache-fra-etou8220034-FRA
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1730898883.756502,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30957
server: nginx

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
969 B 236ms
100ms Script
text/javascript 142.250.185.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: sparkasseid.info
URL: https://sparkasseid.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f4.1e100.net

Software

ESF /

Resource Hash

2108ac60bc352011468c22c5405ad3d88912de0a4d76200e8869e7a4d7ff0e07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Wed, 06 Nov 2024 13:14:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Wed, 06 Nov 2024 13:14:43 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 loading-spk.gif
sparkasseid.info/images/ 415 KB
415 KB 345ms
344ms Image
image/gif 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparkasseid.info/images/loading-spk.gif
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: a1e3d1365b06e4e233058ecc48c69421c44303a81e9683a57a9644fca621a11a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

etag: "64bdf00e-67b89"
accept-ranges: bytes
content-length: 424841
date: Wed, 06 Nov 2024 13:28:06 GMT
content-type: image/gif
last-modified: Mon, 24 Jul 2023 03:29:18 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 404 Sparkasse_web_Bd.woff
sparkasseid.info/fonts/ 0
0 193ms
61ms Font
text/html 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/fonts/Sparkasse_web_Bd.woff
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/css/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/css/app.css

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:28:07 GMT
etag: W/"328-61453c9d36247"
content-type: text/html
last-modified: Sat, 23 Mar 2024 13:19:21 GMT
server: nginx

GET
H2 200 Sparkasse_web_Rg.woff
sparkasseid.info/fonts/ 24 KB
25 KB 222ms
71ms Font
font/woff 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/fonts/Sparkasse_web_Rg.woff
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/css/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 43a2c75ca73d8c1101ff7ae617e6dbc6934e8aa1cd72d64ce50908ac297156cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/css/app.css

Response headers

etag: "6410c12c-61f4"
accept-ranges: bytes
content-length: 25076
date: Wed, 06 Nov 2024 13:28:07 GMT
content-type: font/woff
last-modified: Tue, 14 Mar 2023 18:47:08 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 Sparkasse_web_Bd.ttf
sparkasseid.info/fonts/ 50 KB
50 KB 65ms
64ms Font
font/ttf 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/fonts/Sparkasse_web_Bd.ttf
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/css/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 2531cb7acd60ec49f05916ca751a3bbf990cb5c674cdd9265086c38788771959

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/css/app.css

Response headers

etag: "6410c1ce-c704"
accept-ranges: bytes
content-length: 50948
date: Wed, 06 Nov 2024 13:28:07 GMT
content-type: font/ttf
last-modified: Tue, 14 Mar 2023 18:49:50 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/ 547 KB
217 KB 73ms
17ms Script
text/javascript 216.58.212.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f3.1e100.net

Software

sffe /

Resource Hash

5abe2a12140edf2387d5be35225df3caa4f0f0a05d8f5614008c8cc90af4a156

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/

Response headers

content-encoding: gzip
age: 75804
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Wed, 05 Nov 2025 16:11:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 05 Nov 2024 16:11:19 GMT
last-modified: Tue, 22 Oct 2024 00:01:33 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 222594
x-xss-protection: 0
server: sffe

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame D443 0
0 126ms
43ms Document
text/html 142.250.185.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2&co=aHR0cHM6Ly9zcGFya2Fzc2VpZC5pbmZvOjQ0Mw..&hl=de&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=1iseue7473rv

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zvC_YTy9HFWoNKZY0a_SaA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sparkasseid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-zvC_YTy9HFWoNKZY0a_SaA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Nov 2024 13:14:44 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 script.js Show response
api.inetstatic.com/tracking/ 137 B
861 B 809ms
122ms Script
text/javascript 104.21.20.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.inetstatic.com/tracking/script.js?referrer=https://sparkasseid.info/
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/js/jquery-ui.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.1
Resource Hash: 602a881febdd0811160e14cadb7cb2d31381d10ea9776062a8772e2073f96dfc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6EA%2B28L907yJ6sAydk5RDQx0vlb8DVz9wlt5EFOtazdbvkryPHdmTu2Lk%2FgR8O6XsW6DIx%2FR6FSj3cUlL8KxcsHPGWo4%2BnYcYe%2FLT0ywNFtHECiioaFJSf9KNal%2BQH3YUM6x%2FuE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19171&sent=13&recv=10&lost=0&retrans=0&sent_bytes=4205&recv_bytes=4408&delivery_rate=1218&cwnd=12000&unsent_bytes=0&cid=5e877a7a8a8bbcea&ts=724&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 13:14:45 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With,content-type
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8de55930692799ab-CDG
access-control-allow-origin: https://sparkasseid.info
x-powered-by: PHP/8.2.1
server: cloudflare

GET
H2 200 favicon.ico
sparkasseid.info/images/ 4 KB
4 KB 75ms
74ms Other
image/vnd.microsoft.icon 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/images/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d527da1e5069fa2d735eabd5d481247a8157ef10c550255c484026af3562970d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

etag: "64bdf7a6-10be"
accept-ranges: bytes
content-length: 4286
date: Wed, 06 Nov 2024 13:28:08 GMT
content-type: image/vnd.microsoft.icon
last-modified: Mon, 24 Jul 2023 04:01:42 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame DD85 0
0 35ms
26ms Document
text/html 142.250.185.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=-ZG7BC9TxCVEbzIO2m429usb&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.68 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UyVYjgwQTXP-ayLtxg76og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sparkasseid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-UyVYjgwQTXP-ayLtxg76og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Nov 2024 13:14:46 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sparkasseid.info/	1970-01-21 00:48:58	Name: PHPREFS Value: full

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sparkasseid.info/fonts/Sparkasse_web_Bd.woff Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anal-lytics.site
api.inetstatic.com
code.jquery.com
sparkasseid.info
www.google.com
www.gstatic.com
104.21.20.107
142.250.185.68
185.185.69.181
216.58.212.163
2a04:4e42::649
2a06:98c1:3120::3
1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239
2108ac60bc352011468c22c5405ad3d88912de0a4d76200e8869e7a4d7ff0e07
2531cb7acd60ec49f05916ca751a3bbf990cb5c674cdd9265086c38788771959
43a2c75ca73d8c1101ff7ae617e6dbc6934e8aa1cd72d64ce50908ac297156cb
5abe2a12140edf2387d5be35225df3caa4f0f0a05d8f5614008c8cc90af4a156
5af098721b219c4801711bad963757a6cbac2aa2d4cfcde9ee7aec943219c066
602a881febdd0811160e14cadb7cb2d31381d10ea9776062a8772e2073f96dfc
63e72211b14fd60bbd0297df351621ff058717b129732429ce12c0db6d19144b
9b430d03b29fd0cee8fd51c4ce9c09ece8e013a1403900e72e11019bad53e8e3
a1e3d1365b06e4e233058ecc48c69421c44303a81e9683a57a9644fca621a11a
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b0fb363c54d6747d3609153c3cf96424e27e806162de5f7083e7fc37fd540833
c6ce7c8d3cdd2175bfb851d5fb45fe42b004ce4832f2b950db31b8fe5cf9cf6a
cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c
d527da1e5069fa2d735eabd5d481247a8157ef10c550255c484026af3562970d
d7bf5175d05e81bec066f1e5b222d0ca71f1f68311123a9c28271f4be0e01e55
d8ad9ac7b82f1b3feb913e78d5177210c73131d217d6db6e7a18c6fb91e582e9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3a3ead6613706b3ed572ffc5dfda04d0dbd23ee3ca531b0667bce2fc13cf66
f008c09173b9230f184fdbcf0fcbf3c4fc8daf1bea6c41b3614f5a3a11e9d376

sparkasseid.info Open in urlscan Pro 185.185.69.181 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

100 %HTTPS

33 %IPv6

6 Domains

6 Subdomains

6 IPs

3 Countries

1182 kBTransfer

4309 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

sparkasseid.info Open in urlscan Pro
185.185.69.181 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

1182 kB
Transfer

4309 kB
Size

1
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!