sparka-kundengeheimnis.com Open in urlscan Pro
185.185.70.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D
Effective URL:
https://sparka-kundengeheimnis.com/C9JFX5FKAE
Submission Tags: falconsandbox
Submission: On September 15 via api (September 15th 2022, 12:40:29 pm UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 15 HTTP transactions. The main IP is 185.185.70.52, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is sparka-kundengeheimnis.com.
TLS certificate: Issued by R3 on September 14th 2022. Valid for: 3 months.

This is the only time sparka-kundengeheimnis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	213.150.196.36 213.150.196.36	327862 (NOSi) (NOSi)
12	185.185.70.52 185.185.70.52	35278 (SPRINTHOST) (SPRINTHOST)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
15	3

2 213.150.196.36 (Cabo Verde) 1 redirects

ASN327862 (NOSi, CV)
PTR: cp1.nosiwebhosting.com

investclimate.ecowas.int	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 185.185.70.52 (Russian Federation)

ASN35278 (SPRINTHOST, RU)

sparka-kundengeheimnis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	sparka-kundengeheimnis.com sparka-kundengeheimnis.com	2 MB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 654	132 KB
2	ecowas.int 1 redirects investclimate.ecowas.int	527 B
15	3

	Domain	Requested by
12	sparka-kundengeheimnis.com	sparka-kundengeheimnis.com
2	code.jquery.com	sparka-kundengeheimnis.com
2	investclimate.ecowas.int	1 redirects
15	3

This site contains no links.

Subject Issuer	Validity	Valid
*.ecowas.int Sectigo RSA Domain Validation Secure Server CA	`2022-01-27` - `2023-02-27`	a year	crt.sh
sparka-kundengeheimnis.com R3	`2022-09-14` - `2022-12-13`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sparka-kundengeheimnis.com/C9JFX5FKAE
Frame ID: 3CE2404C869E1726ED7323066828C1D1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SparkasseSecure+ Umstellung | Sparkasse

Page URL History Show full URLs

http://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQ... HTTP 301
https://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQ... Page URL
https://sparka-kundengeheimnis.com/C9JFX5FKAE Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*parbase

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

15
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

2617 kB
Transfer

3097 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D HTTP 301
https://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D Page URL
https://sparka-kundengeheimnis.com/C9JFX5FKAE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D HTTP 301
https://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	pcltrace.php Show response investclimate.ecowas.int/ Redirect Chain http://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D https://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D	90 B 192 B	368ms 172ms	Document text/html	213.150.196.36 NOSi
General Check archive.org Show headers Download Go to Full URL https://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.150.196.36 , Cabo Verde, ASN327862 (NOSi, CV), Reverse DNS cp1.nosiwebhosting.com Software Apache / PHP/7.4.30 Resource Hash `08d1a61e0a251d213f82e35d67cdbb60c2d01548c12553fbab99617405176cb8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-type text/html; charset=UTF-8 date Thu, 15 Sep 2022 12:40:23 GMT server Apache x-powered-by PHP/7.4.30 Redirect headers Connection Keep-Alive Content-Length 322 Content-Type text/html; charset=iso-8859-1 Date Thu, 15 Sep 2022 12:40:23 GMT Keep-Alive timeout=5, max=100 Location https://investclimate.ecowas.int/pcltrace.php?r=bD1odHRwczovL3NwYXJrYS1rdW5kZW5nZWhlaW1uaXMuY29tL0M5SkZYNUZLQUU%3D Server Apache
GET H/1.1	200 OK	Primary Request C9JFX5FKAE Show response sparka-kundengeheimnis.com/	80 KB 18 KB	925ms 218ms	Document text/html	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `5eaa073836b4aac67271aecd610a9ed4912661ba126435d4626c5cc3df122241` Request headers Referer https://investclimate.ecowas.int/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Thu, 15 Sep 2022 12:40:25 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server nginx Transfer-Encoding chunked
GET H2	200	jquery-ui.css code.jquery.com/ui/1.13.1/themes/base/	35 KB 8 KB	1212ms 1074ms	Stylesheet text/css	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/ui/1.13.1/themes/base/jquery-ui.css Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `58a6f49e92f7d2fd1246d98c568c2ac7d6be832ddfece67ec9f7ef3332766adf` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 12:40:26 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:40 GMT server nginx etag W/"620cd700-8d03" vary Accept-Encoding x-hw 1663245626.dop202.fr8.t,1663245626.cds167.fr8.hn,1663245626.cds141.fr8.c content-type text/css access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 8356
GET H/1.1	200 OK	internetfiliale.min.css sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/	1 MB 1 MB	68ms 68ms	Stylesheet text/css	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `a914f6b586a82a465b80ad4eff1132f00307932841c2e785541c0e5eb5f3a4ef` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:25 GMT Last-Modified Mon, 12 Sep 2022 16:32:35 GMT Server nginx ETag "631f5f23-17e7ba" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1566650
GET H/1.1	200 OK	internetfiliale.min.js Show response sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/	433 KB 434 KB	286ms 138ms	Script application/javascript	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.js Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `9458c9806502a7e9c0e8b5bf28f6b26a07548e36882e75c16d6986e8b164ba80` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:26 GMT Last-Modified Mon, 12 Sep 2022 16:32:35 GMT Server nginx ETag "631f5f23-6c531" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 443697
GET H/1.1	200 OK	logo_ini.svg sparka-kundengeheimnis.com/	22 KB 22 KB	73ms 73ms	Image image/svg+xml	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL https://sparka-kundengeheimnis.com/logo_ini.svg Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:31:19 GMT Server nginx ETag "631f5ed7-58be" Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 22718
GET H/1.1	200 OK	392x696bb.png sparka-kundengeheimnis.com/	59 KB 59 KB	64ms 63ms	Image image/png	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL https://sparka-kundengeheimnis.com/392x696bb.png Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `0df49764e93dcf8428f964409c7f0bc600f18981ee3e1ebf251bed1d3932d1aa` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:36:05 GMT Server nginx ETag "631f5ff5-ec49" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 60489
GET H/1.1	404 Not Found	1640088281840.png sparka-kundengeheimnis.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award/image.img.png/	16 B 16 B	210ms 63ms	Image text/html	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL https://sparka-kundengeheimnis.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award/image.img.png/1640088281840.png Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Content-Encoding gzip Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	1640088282484.png sparka-kundengeheimnis.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/	16 B 16 B	210ms 63ms	Image text/html	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL https://sparka-kundengeheimnis.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/1640088282484.png Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Content-Encoding gzip Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery-ui.js Show response code.jquery.com/ui/1.13.1/	517 KB 124 KB	233ms 233ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/ui/1.13.1/jquery-ui.js Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 12:40:27 GMT content-encoding gzip last-modified Thu, 20 Jan 2022 14:12:59 GMT server nginx etag W/"61e96deb-812a6" vary Accept-Encoding x-hw 1663245627.dop202.fr8.t,1663245627.cds167.fr8.hn,1663245627.cds242.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 126241
GET H/1.1	200 OK	Sparkasse_web_Rg.woff sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/	41 KB 41 KB	101ms 64ms	Font application/font-woff	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Rg.woff Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451` Request headers Referer https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Origin https://sparka-kundengeheimnis.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:32:35 GMT Server nginx ETag "631f5f23-a200" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 41472
GET H/1.1	200 OK	pictos-if.woff sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/	197 KB 198 KB	179ms 77ms	Font application/font-woff	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/pictos-if.woff Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `385bbee80414712855e9a4250cd4dcbbff192dc79136cf99fa5b62075d3bb0ad` Request headers Referer https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Origin https://sparka-kundengeheimnis.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:32:35 GMT Server nginx ETag "631f5f23-315c8" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 202184
GET H/1.1	200 OK	Sparkasse_web_Bd.woff sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/	36 KB 36 KB	185ms 64ms	Font application/font-woff	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Bd.woff Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002` Request headers Referer https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Origin https://sparka-kundengeheimnis.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:32:35 GMT Server nginx ETag "631f5f23-901c" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 36892
GET H/1.1	200 OK	SparkasseHead_web_Rg.woff sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/	29 KB 30 KB	226ms 124ms	Font application/font-woff	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale/fonts/SparkasseHead_web_Rg.woff Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86` Request headers Referer https://sparka-kundengeheimnis.com/filialauswahl_assets/clientlibs/myif/master/base/internetfiliale.min.css Origin https://sparka-kundengeheimnis.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:32:35 GMT Server nginx ETag "631f5f23-7550" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 30032
GET H/1.1	200 OK	1608194651895.jpg sparka-kundengeheimnis.com/	117 KB 117 KB	128ms 123ms	Image image/jpeg	185.185.70.52 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL https://sparka-kundengeheimnis.com/1608194651895.jpg Requested by Host: sparka-kundengeheimnis.com URL: https://sparka-kundengeheimnis.com/C9JFX5FKAE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.185.70.52 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `e7ae4d3aa60ef6c112d92d36ade9da9a057992e855aa5eb9d327050c7b3d6d1a` Request headers accept-language de-DE,de;q=0.9 Referer https://sparka-kundengeheimnis.com/C9JFX5FKAE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Thu, 15 Sep 2022 12:40:27 GMT Last-Modified Mon, 12 Sep 2022 16:34:28 GMT Server nginx ETag "631f5f94-1d418" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 119832

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sparka-kundengeheimnis.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: fbloetm4l5g7medetcqntbmtem

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sparka-kundengeheimnis.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award/image.img.png/1640088281840.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://sparka-kundengeheimnis.com/content/myif/ssk-dessau/work/filiale/fi/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/1640088282484.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
investclimate.ecowas.int
sparka-kundengeheimnis.com
185.185.70.52
2001:4de0:ac18::1:a:3a
213.150.196.36
08d1a61e0a251d213f82e35d67cdbb60c2d01548c12553fbab99617405176cb8
0df49764e93dcf8428f964409c7f0bc600f18981ee3e1ebf251bed1d3932d1aa
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451
2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a
385bbee80414712855e9a4250cd4dcbbff192dc79136cf99fa5b62075d3bb0ad
58a6f49e92f7d2fd1246d98c568c2ac7d6be832ddfece67ec9f7ef3332766adf
5eaa073836b4aac67271aecd610a9ed4912661ba126435d4626c5cc3df122241
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
9458c9806502a7e9c0e8b5bf28f6b26a07548e36882e75c16d6986e8b164ba80
a914f6b586a82a465b80ad4eff1132f00307932841c2e785541c0e5eb5f3a4ef
e7ae4d3aa60ef6c112d92d36ade9da9a057992e855aa5eb9d327050c7b3d6d1a
e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276
e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86

sparka-kundengeheimnis.com Open in urlscan Pro 185.185.70.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

2617 kBTransfer

3097 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

42 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

sparka-kundengeheimnis.com Open in urlscan Pro
185.185.70.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

2617 kB
Transfer

3097 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!