www-spk-sicherheiten.xyz Open in urlscan Pro
104.21.70.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v
Submission: On September 09 via automatic, source openphish (September 9th 2021, 1:11:26 am UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 104.21.70.153, located in and belongs to CLOUDFLARENET, US. The main domain is www-spk-sicherheiten.xyz.

This is the only time www-spk-sicherheiten.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
8	104.21.70.153 104.21.70.153		13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	1

8 104.21.70.153 (None, )

ASN13335 (CLOUDFLARENET, US)

www-spk-sicherheiten.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	www-spk-sicherheiten.xyz www-spk-sicherheiten.xyz	189 KB
8	1

	Domain	Requested by
8	www-spk-sicherheiten.xyz	www-spk-sicherheiten.xyz
8	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v
Frame ID: 12C0B5CDB87FD1FFE0811F1F528BCF43
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Online-Banking

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*parbase

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

189 kB
Transfer

400 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request anmeldung.php Show response www-spk-sicherheiten.xyz/s/	11 KB 4 KB	322ms 272ms	Document text/html	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `820e9c07a357413578465c3d240848b1574800f2addf6ee4161ecc11e2baddee` Request headers Host www-spk-sicherheiten.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive set-cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding CF-Cache-Status DYNAMIC Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w0ZF9MoAEuFsldOC7Y%2FDC2viuIY5OsaJ6tpas3Iv3wVx9BO6gBYC%2Bkp84%2Bl7NTKVzuOHLazGPY8y4sQXfWlXP9nbwyncRqWS57PVj3nEEsU2QjAAvdoNtsWAkq6Oh8vFex8itYnNAapvXR0%3D"}],"group":"cf-nel","max_age":604800} NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare CF-RAY 68bc8ac81ee427b8-PRG Content-Encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H/1.1	200 OK	ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css www-spk-sicherheiten.xyz/s/src/css/	249 KB 42 KB	20ms 20ms	Stylesheet text/css	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b8b51ca2d76d70709c6c9aa47b504dc4484cf89b508df064dc9c2b53d6ee75c4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT content-encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4172 Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Content-Length 41937 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag "3e436-5c15df5b0fed0-gzip" vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=773K6L6bBCPdZFP2xnHLbOTlTdLNcFYXhXbPKmaJ7ymr5xzxfw4jTpaUM8uihst6%2Bf5KdLAzxZrLehxrLnocIR4Y47QvjgYOdBn%2FJFuLwLeMh%2FhluNIdTiZ%2B7zQh3AQ4%2Bvk3Glyjg%2F4tIKM%3D"}],"group":"cf-nel","max_age":604800} Content-Type text/css Cache-Control max-age=14400 Accept-Ranges bytes CF-RAY 68bc8ac9f84a27b8-PRG
GET H/1.1	200 OK	ZR1pMwPB9Xsl53CW8qSL.png www-spk-sicherheiten.xyz/s/src/img/	2 KB 3 KB	38ms 24ms	Image image/png	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www-spk-sicherheiten.xyz/s/src/img/ZR1pMwPB9Xsl53CW8qSL.png Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b9e830e96a27b155e68fbf2bd76b10c2e9e054874c9c3c1e97bbaea573259894` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4172 Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Content-Length 1902 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag "76e-5c15df5b106a0" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=inEzlIVPFayLTP8ZTscU0bWgnJV01xIm7yq2DY7UowyMk48zJe4iYMxom5ahYs7cql64Z%2B0kpmk9DD3ynTj9MfWwmHI3jpkXoE%2B3OGa4Bopb4gxLJuaZyCpjjYoiR91XU3sxlUAqMov33aA%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 Accept-Ranges bytes CF-RAY 68bc8aca0e452778-PRG
GET H/1.1	200 OK	WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png www-spk-sicherheiten.xyz/s/src/img/	3 KB 3 KB	40ms 25ms	Image image/png	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www-spk-sicherheiten.xyz/s/src/img/WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9ef3568cb4cbc5b4a96dba63ccff15a441eac6d17c91fa963d2ac1b4534520d6` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4172 Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Content-Length 2729 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag "aa9-5c15df5b106a0" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YTnK9%2FbggrbB7Owp8VghUJ8RcGlY1mbwU1MHnUC1pTuBj8fVMj8brVYHOSo3UYqDwB46iMz0xL3gCzk7hDJUKU2Xw%2BK9ddtqTp9cue%2B9fDQO0EC3ZWdCULHjU%2BIIfbzZ%2F30eql1wE9%2FFOpk%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 Accept-Ranges bytes CF-RAY 68bc8aca1923412c-PRG
GET H/1.1	200 OK	spk-logo-druck.png www-spk-sicherheiten.xyz/s/src/img/	10 KB 11 KB	40ms 25ms	Image image/png	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://www-spk-sicherheiten.xyz/s/src/img/spk-logo-druck.png Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d16cd665d719c20820702b390ce43791ec4ae374d5233251b04d578264808684` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www-spk-sicherheiten.xyz/s/anmeldung.php?starten=4g0s7kbj63he2qmivx5lfeoarcasqd&shuffluri?=thh93zzitgpko1bjwf0v User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4172 Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Content-Length 10048 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag "2740-5c15df5b106a0" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zoMPwoklKlJIQojLBs6VFv9TcTnpjQEGL5k9hF35vEVvovBfyFpUdoOViSnHt4LbE%2F6XAivrRzDoGuyRROn0EB%2BUXlmfUe1ktYm0lcEfdmxYDaVPWpgpvPsaPLrAL3q5kRj7okSmOMdr1Po%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 Accept-Ranges bytes CF-RAY 68bc8aca0ca7f9ce-PRG
GET H/1.1	200 OK	pictos-if.woff www-spk-sicherheiten.xyz/s/src/fonts/	48 KB 48 KB	25ms 24ms	Font application/font-woff	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www-spk-sicherheiten.xyz/s/src/fonts/pictos-if.woff Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03` Request headers Pragma no-cache Origin http://www-spk-sicherheiten.xyz Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept / Cache-Control no-cache Referer http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Referer http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Origin http://www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4171 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag W/"be24-5c15df5b0fed0" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TPHknfpg3W6dMgcRbPpek2TnqVcAGdW2HOzE98pc5I01YyGQQ3Gark9isr8pCYFiEwhp%2FKstyfPK%2BkZjO05HgwZ5Mr3dQ7zHNHjI2ruHiTNN39cgUPGTQeUu7KJNgGtbzoqvGQupoDjckKw%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/font-woff Cache-Control max-age=14400 CF-RAY 68bc8aca3cc0f9ce-PRG
GET H/1.1	200 OK	GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff www-spk-sicherheiten.xyz/s/src/fonts/	39 KB 39 KB	21ms 20ms	Font application/font-woff	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www-spk-sicherheiten.xyz/s/src/fonts/GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2` Request headers Pragma no-cache Origin http://www-spk-sicherheiten.xyz Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept / Cache-Control no-cache Referer http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Referer http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Origin http://www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4171 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag W/"9a44-5c15df5b0fed0" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3X6keNDNKS6WDLiqQBCDMEFQLvBkbYAukaa8oCTViBRzxcuzbP6gkc96AktCtR0QJB6scma%2BRUO9vBlqRbQmEbew15aSUTpPGJT72VPDrE7%2FwpKx32g1at10wm8ZiENMNfvPUFn2mT8sKHM%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/font-woff Cache-Control max-age=14400 CF-RAY 68bc8aca494c412c-PRG
GET H/1.1	200 OK	AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff www-spk-sicherheiten.xyz/s/src/fonts/	39 KB 39 KB	19ms 19ms	Font application/font-woff	104.21.70.153 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://www-spk-sicherheiten.xyz/s/src/fonts/AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff Requested by Host: www-spk-sicherheiten.xyz URL: http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Protocol HTTP/1.1 Server 104.21.70.153 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638` Request headers Pragma no-cache Origin http://www-spk-sicherheiten.xyz Accept-Encoding gzip, deflate Host www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept / Cache-Control no-cache Referer http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Cookie PHPSESSID=d3r419q48e67etb1pkunpjkv8o Connection keep-alive Referer http://www-spk-sicherheiten.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Origin http://www-spk-sicherheiten.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 09 Sep 2021 01:11:21 GMT Content-Encoding gzip CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 4171 Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Sun, 02 May 2021 19:36:21 GMT Server cloudflare etag W/"9b38-5c15df5b0fed0" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kg8WDr44UiqiMSNzfu9AVia7CAN53d8oxaJ4ihGH42lopNxO45Xnxj%2FoBNUnyXVLAQFDXRZuQxFPUi0GjRdqmA%2FHuphnml%2FfpAg9xx69Z6Mg%2BqC22q%2BKxJJw8MDCXj9%2BS6qpQlN95zbKObM%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/font-woff Cache-Control max-age=14400 CF-RAY 68bc8aca3e5f2778-PRG

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www-spk-sicherheiten.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: d3r419q48e67etb1pkunpjkv8o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www-spk-sicherheiten.xyz
104.21.70.153
56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03
820e9c07a357413578465c3d240848b1574800f2addf6ee4161ecc11e2baddee
9ef3568cb4cbc5b4a96dba63ccff15a441eac6d17c91fa963d2ac1b4534520d6
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
b8b51ca2d76d70709c6c9aa47b504dc4484cf89b508df064dc9c2b53d6ee75c4
b9e830e96a27b155e68fbf2bd76b10c2e9e054874c9c3c1e97bbaea573259894
d16cd665d719c20820702b390ce43791ec4ae374d5233251b04d578264808684
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

www-spk-sicherheiten.xyz Open in urlscan Pro 104.21.70.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

189 kBTransfer

400 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

www-spk-sicherheiten.xyz Open in urlscan Pro
104.21.70.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

189 kB
Transfer

400 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!