meine-santandersign.de Open in urlscan Pro
2606:4700:3031::ac43:bbf3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://meine-santandersign.de/aktivierung
Submission: On November 22 via manual (November 22nd 2024, 3:40:42 pm UTC) from ES — Scanned from DE

Summary HTTP 10 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3031::ac43:bbf3, located in United States and belongs to CLOUDFLARENET, US. The main domain is meine-santandersign.de.
TLS certificate: Issued by WE1 on November 14th 2024. Valid for: 3 months.

This is the only time meine-santandersign.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3031::ac43:bbf3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:e981:2c::45 2a02:e981:2c::45	19551 (INCAPSULA) (INCAPSULA)
10	2

9 2606:4700:3031::ac43:bbf3 (United States)

ASN13335 (CLOUDFLARENET, US)

meine-santandersign.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:e981:2c::45 (United States)

ASN19551 (INCAPSULA, US)

meine.santander.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	meine-santandersign.de meine-santandersign.de	47 KB
1	santander.de meine.santander.de — Cisco Umbrella Rank: 835061	2 KB
10	2

	Domain	Requested by
9	meine-santandersign.de	meine-santandersign.de
1	meine.santander.de
10	2

This site contains links to these domains. Also see Links.

Domain
www.santander.de
santander.de

Subject Issuer	Validity	Valid
meine-santandersign.de WE1	`2024-11-14` - `2025-02-12`	3 months	crt.sh
imperva.com GlobalSign Atlas R3 DV TLS CA 2024 Q4	`2024-10-18` - `2025-04-16`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://meine-santandersign.de/aktivierung
Frame ID: 5298461D89A27F29D5B1936599B508FE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Santander - SantanderSign aktualisierung

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

49 kB
Transfer

145 kB
Size

3
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.santander.de/privatkunden/service-kontakt/information/sicherheit/onlinesicherheit/
Title: Mehr

Search URL Search Domain Scan URL

URL: https://santander.de/visa-debitkarte
Title: Mehr

Search URL Search Domain Scan URL

URL: https://www.santander.de/santandersign-ios
Title: Apple Store

Search URL Search Domain Scan URL

URL: https://www.santander.de/santandersign-android
Title: Google Play Store

Search URL Search Domain Scan URL

URL: https://santander.de/hotlines
Title: Mehr

Search URL Search Domain Scan URL

URL: https://www.santander.de/hilfe
Title: Hilfe

Search URL Search Domain Scan URL

URL: https://www.santander.de/hotlines
Title: Kontakt

Search URL Search Domain Scan URL

URL: https://www.santander.de/standortsuche
Title: Filialfinder

Search URL Search Domain Scan URL

URL: https://www.santander.de/sicherheit
Title: Sicherheitshinweise

Search URL Search Domain Scan URL

URL: https://www.santander.de/datenschutz
Title: Datenschutz

Search URL Search Domain Scan URL

URL: https://www.santander.de/impressum
Title: Impressum

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request aktivierung Show response
meine-santandersign.de/ 56 KB
15 KB 210ms
147ms Document
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://meine-santandersign.de/aktivierung

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbfed17b53828af17d57a5ffad4f8ba4ecd9175412258d1382feee7ba5375a71

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e6a04cfced1d33f-CDG
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Fri, 22 Nov 2024 15:40:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: same-origin, same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRJ%2Bd7mUvAT3cL7TGayY1DCa16Z1cmQBRsyqpYEQPt9QufCGtagovlJ5QZFf0Hsrx7Aeh%2B23rAcYkZy6OzAdlyV1c7ujjeT6gwDjcjTRyUoJHMn10u5I7qi1kVKPmuhLnnCnT6Fa1oTd32ZqZZV79KFWOXAJ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=15376&sent=7&recv=11&lost=0&retrans=0&sent_bytes=4004&recv_bytes=2371&delivery_rate=257880&cwnd=253&unsent_bytes=0&cid=39d2f11e7dd50a67&ts=154&x=0"
vary: Accept-Encoding
x-content-type-options: nosniff, nosniff
x-frame-options: SAMEORIGIN, SAMEORIGIN
x-permitted-cross-domain-policies: master-only, master-only
x-xss-protection: 1; mode=block, 1; mode=block

GET
H2 404 style.css
meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/ 0
0 126ms
124ms Stylesheet
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/style.css
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5w%2BMiYFmJYqFG4MQjqJl1nFXofr82iEfupRE7plPcw306BqgnD%2FeoM8BkBTSzCbVUxLhs65%2B5JtzBIbUhXj9oEPK7BPxixClTJXBfZnI3%2BGBGHbbX50huEuAw70X7n4tsSmT8jPUKD%2FOKSw4wUdcwhd2Wx8"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d0f86bd33f-CDG
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=15394&sent=29&recv=18&lost=0&retrans=0&sent_bytes=19940&recv_bytes=2822&delivery_rate=1206468&cwnd=257&unsent_bytes=0&cid=39d2f11e7dd50a67&ts=318&x=0"
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 404 jquery.min.js
meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/ 0
0 123ms
122ms Script
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/jquery.min.js
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=10MRRZ4SMaqAEL6Nulq187sjjtn0aG6ikiSs4uZyqrTTa%2B1O6MW9n0mhlyZydjlyx2wO107kdOQ%2FhshizRaee8PW0S%2FEPqkJram4oWrkZXP7JOHsku%2FUpIK4SQh9EOxSi%2B%2B6g3rBMUuGghv5ei0GnOtcLxcf"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d0f86dd33f-CDG
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=15394&sent=26&recv=18&lost=0&retrans=0&sent_bytes=19273&recv_bytes=2822&delivery_rate=1206468&cwnd=257&unsent_bytes=0&cid=39d2f11e7dd50a67&ts=316&x=0"
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 404 script.js
meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/ 0
0 126ms
126ms Script
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/script.js
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aAZ8IJ2pUzOdXSjsOZvHgz4R8NhTQJMMBCmb9XgOM1jHiGBJXCD8%2F4zy1AG06WKP1VhqZOKygRN6XKf7XxX0F%2B8G1oqU7AZ%2FTwels6GDSfnUN%2BIe6o%2FZOjb1irV62UZNv7XmlSwlv9D8yt%2FB51gPEiqoVbCk"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d0f86fd33f-CDG
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=15394&sent=32&recv=18&lost=0&retrans=0&sent_bytes=20584&recv_bytes=2822&delivery_rate=1206468&cwnd=257&unsent_bytes=0&cid=39d2f11e7dd50a67&ts=319&x=0"
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 200 jquery-3.6.0.min.js Show response
meine-santandersign.de/assets/ 87 KB
33 KB 166ms
165ms Script
application/javascript 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/assets/jquery-3.6.0.min.js
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://meine-santandersign.de/aktivierung

Response headers

content-encoding: zstd
cf-cache-status: MISS
etag: W/"66b2708b-15d9f"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cpvj7ZP0XgHaGIG0faAQLki2%2Fge5pJQLHAa3ALO1O1YOexRojL9jt%2Fc596Wwi3T8NPRknwedcCe6f3DwYWLs9wX0hddPZSZQg0o4YYkjyIBbON7uUjRCslziSMJtoVhnaChRDRtbIQn36AxwROv6xk7s497Z"}],"group":"cf-nel","max_age":604800}
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=15523&sent=35&recv=21&lost=0&retrans=0&sent_bytes=21240&recv_bytes=2822&delivery_rate=1206468&cwnd=257&unsent_bytes=0&cid=39d2f11e7dd50a67&ts=357&x=0"
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: application/javascript
last-modified: Tue, 06 Aug 2024 18:50:51 GMT
vary: Accept-Encoding
cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e6a04d0f870d33f-CDG
access-control-allow-origin: *
server: cloudflare

GET
H3 404 SantanderHeadlineW05-Bold.ed7772dd.woff
meine-santandersign.de/font/ 0
0 129ms
128ms Font
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/font/SantanderHeadlineW05-Bold.ed7772dd.woff
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://meine-santandersign.de
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GtOfey7qYKmyEWbYmjxuisRJy0ziXFN4Zi74rGEn17vNqBLoOUZWue%2FDBezgzPDXeinK4Zacpb7DmR1DfxRCVcEVS89Cs1rYHwA17a0PGrn8dqQ4%2BqNdydw1dqDwUjqVqIbUq9aNuxgGJXpA5xbTMVokihoD"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d1dc02dcaa-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7299&sent=17&recv=14&lost=0&retrans=0&sent_bytes=6017&recv_bytes=5492&delivery_rate=888&cwnd=12000&unsent_bytes=0&cid=b3a9b5d7a30890db&ts=244&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare
priority: u=0,i=?0

GET
H3 404 SantanderMicroTextW05-Rg.23bf5fda.woff
meine-santandersign.de/font/ 0
0 116ms
116ms Font
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/font/SantanderMicroTextW05-Rg.23bf5fda.woff
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://meine-santandersign.de
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BW3Ab%2BjIZ1hTgWEKDR0nLaOubEyzs3DpoNk%2FS76YxNWrB%2FhBA1GrSuyjFPvxp0B2L3lxt2EtZ65lF0FVq8yddNb9LdfB6rn8%2BTU3x3DoLCegmesVF4Kt81H7uZ9i7pNdHVfDUsQ0MLhTdg2ZtD3Ai2z9PTVi"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d1dc06dcaa-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7299&sent=13&recv=14&lost=0&retrans=0&sent_bytes=4290&recv_bytes=5492&delivery_rate=888&cwnd=12000&unsent_bytes=0&cid=b3a9b5d7a30890db&ts=238&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare
priority: u=0,i=?0

GET
H3 404 SantanderMicroTextW05-Bold.025b01e5.woff
meine-santandersign.de/font/ 0
0 119ms
118ms Font
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/font/SantanderMicroTextW05-Bold.025b01e5.woff
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://meine-santandersign.de
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xh0O5%2BNDkbYsI5PTom%2FNUVxFJYHYAfjF4ZTKH3KhjIiSSDk7FqJYK2CcDJz7uRPI1vXZO4w6t5pjKxd8MhysUI7VGbtv8OhbwefbX6WqvklqlxHLhM%2BTwB7E7Z0ymil%2BKQZVKCMszSowmThx5rh6%2B%2BSejLXP"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d1dc07dcaa-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7299&sent=15&recv=14&lost=0&retrans=0&sent_bytes=5169&recv_bytes=5492&delivery_rate=888&cwnd=12000&unsent_bytes=0&cid=b3a9b5d7a30890db&ts=238&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare
priority: u=0,i=?0

GET
H3 404 SantanderText-Regular.bf509714.woff
meine-santandersign.de/font/ 0
0 131ms
131ms Font
text/html 2606:4700:3031::ac43:bbf3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://meine-santandersign.de/font/SantanderText-Regular.bf509714.woff
Requested by: Host: meine-santandersign.de
URL: https://meine-santandersign.de/aktivierung
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:bbf3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://meine-santandersign.de
Referer: https://meine-santandersign.de/aktivierung

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lZ0Pc7d3lvvF%2BfXDeIgP4ui6aumHl9rdCDJPAnZqo7ITLbhiXYeIq19Ngbc2zdA9WA7caaQ1MuZiFPMicg8ywILzDiQPf2Yy2kNxjdUl%2FkbcxyTRjsMrLzc3PGBApXyzXmCFdi16W3cRaCevYBLyW2fg3SsO"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e6a04d1dc0adcaa-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=7299&sent=19&recv=14&lost=0&retrans=0&sent_bytes=6859&recv_bytes=5492&delivery_rate=888&cwnd=12000&unsent_bytes=0&cid=b3a9b5d7a30890db&ts=254&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 22 Nov 2024 15:40:35 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare
priority: u=0,i=?0

GET
H2 200 favicon-32x32.png
meine.santander.de/login/ 1 KB
2 KB 1097ms
695ms Other
image/png 2a02:e981:2c::45
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://meine.santander.de/login/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:e981:2c::45 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

df229e46b8fe5789762688e6acc2820d64ff635aa5915a7820f178df8bf48a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
x-test: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
x-iinfo: 6-1979693-1979696 NNNN CT(169 172 0) RT(1732290035088 183) q(0 0 4 0) r(5 5) U24
cache-control: max-age=2592000, public, private
etag: "66a8c4a3-4f8"
pragma: public
x-cdn: Imperva
expires: Sun, 22 Dec 2024 15:40:36 GMT
accept-ranges: bytes
content-length: 1272
date: Fri, 22 Nov 2024 15:40:36 GMT
content-type: image/png
last-modified: Tue, 30 Jul 2024 10:46:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| bid object| php_js function| $ function| jQuery

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
meine.santander.de/	1969-12-31 23:59:59	Name: f9b4a3ddd03ee8ba92a245593f6b5259 Value: ece4a6327feb60a4e75e79865b7b0e5c
.santander.de/	1969-12-31 23:59:59	Name: nlbi_2187745 Value: 7WfeOvZqJnIdu9ptiNkT6QAAAABnrKwfHVpnSuH5ISC6//ON
.santander.de/	1969-12-31 23:59:59	Name: incap_ses_164_2187745 Value: sHPqOqNanxht7ua5cKVGAvOlQGcAAAAAZl6Rovxr3IOKMR/mSCsruA==

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/jquery.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/style.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://meine-santandersign.de/Santander%20-%20SantanderSign%20aktualisierung-Dateien/script.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://meine-santandersign.de/font/SantanderMicroTextW05-Rg.23bf5fda.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://meine-santandersign.de/font/SantanderMicroTextW05-Bold.025b01e5.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://meine-santandersign.de/font/SantanderHeadlineW05-Bold.ed7772dd.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://meine-santandersign.de/font/SantanderText-Regular.bf509714.woff Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

meine-santandersign.de
meine.santander.de
2606:4700:3031::ac43:bbf3
2a02:e981:2c::45
cbfed17b53828af17d57a5ffad4f8ba4ecd9175412258d1382feee7ba5375a71
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
df229e46b8fe5789762688e6acc2820d64ff635aa5915a7820f178df8bf48a3c

meine-santandersign.de Open in urlscan Pro 2606:4700:3031::ac43:bbf3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

49 kBTransfer

145 kBSize

3 Cookies

11 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

3 Cookies

7 Console Messages

Security Headers

Indicators

meine-santandersign.de Open in urlscan Pro
2606:4700:3031::ac43:bbf3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

49 kB
Transfer

145 kB
Size

3
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!