spk.support24-customers.de Open in urlscan Pro
2606:4700:3033::6815:159 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://spk.support24-customers.de/?tkn=a087
Submission: On August 04 via automatic, source phishtank (August 4th 2022, 5:18:59 pm UTC) — Scanned from DE

Summary HTTP 10 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3033::6815:159, located in United States and belongs to CLOUDFLARENET, US. The main domain is spk.support24-customers.de.
TLS certificate: Issued by E1 on August 2nd 2022. Valid for: 3 months.

This is the only time spk.support24-customers.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
10	2606:4700:303... 2606:4700:3033::6815:159		13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	1

10 2606:4700:3033::6815:159 (United States)

ASN13335 (CLOUDFLARENET, US)

spk.support24-customers.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	support24-customers.de spk.support24-customers.de	485 KB
10	1

	Domain	Requested by
10	spk.support24-customers.de	spk.support24-customers.de
10	1

This site contains links to these domains. Also see Links.

Domain
kredit.skpk.de
web.s-investor.de
t23.intelliad.de
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
blog.berliner-sparkasse.de

Subject Issuer	Validity	Valid
*.support24-customers.de E1	`2022-08-02` - `2022-10-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spk.support24-customers.de/?tkn=a087
Frame ID: FA5A1D98D16FA3A26D4098F6472C8786
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Internet-Filiale - Sparkasse

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

485 kB
Transfer

1996 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://kredit.skpk.de/?template=Privatkredit_Berlin&utm_source=if6&utm_medium=bsk&utm_campaign=mv_pkvv_17_08&utm_content=footer
Title: S-Privatkredit

Search URL Search Domain Scan URL

URL: https://web.s-investor.de/app/markt.htm?INST_ID=0004093&ident=0
Title: BörsenCenter

Search URL Search Domain Scan URL

URL: http://t23.intelliad.de/index.php?redirect=https%3A%2F%2Fwww.berliner-sparkasse.de%2Fde%2Fhome%2Fservice%2Fnewsletter.html&cl=0383839313236323131303&bm=100&bmcl=6353835313236323131303&cp=893&ag=124&crid=108
Title: Newsletter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/berlinersparkasse
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/BerlinerSPK
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/berlinersparkasse/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/berlinersparkasse
Title: Youtube

Search URL Search Domain Scan URL

URL: http://blog.berliner-sparkasse.de/
Title: Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
spk.support24-customers.de/ 1 KB
1 KB 161ms
109ms Document
text/html 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/?tkn=a087
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91e2ddb27aa45076fc969c83720a61376c13512afc9a8cbfc4c2c135d16f8b9b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7358f479ff5b6963-FRA
content-encoding: br
content-type: text/html
date: Thu, 04 Aug 2022 17:18:55 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Mon, 11 Jul 2022 19:47:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JAvI6WTzz682%2BsLN%2Bgj9kOYI%2Fb59q6iob5S0dklvPTcRAbsVXOw8c%2BcYEg6SHBRdnkkD8Ctaj4I4KUx%2Bx7L2IAEoCsb7LGykFa0%2BTxyKUKpcDK%2B6V6WLe3OhJH6u4qNCd8PnQgZ3qX2BG36Qji1bW%2B52haeHWd6%2Bmw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 style.css
spk.support24-customers.de/css/ 1 MB
160 KB 54ms
53ms Stylesheet
text/css 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/css/style.css
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/?tkn=a087
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eddcb059236ed4f4f7fce2060dcfa34eae43c11edfd3f2c17a51eecb144b2f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spk.support24-customers.de/?tkn=a087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Jul 2022 19:47:26 GMT
server: cloudflare
age: 1176
etag: W/"62cc7e4e-16707b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A9bac4d2l0v2iFvcBuutvxipn1kgSUMt97N8BsmdYPBUhneHWuYVw%2BVEkdj2iTOWGk%2F04MFxT0HXHr0evGB4DJ2vxvgkDKiuBaf7EuVpUsfsEU6nbXMjkarIMOBbmlg6EO7Ca0E%2FvQuy7JeaqBKVAa8Sev0JuZsorA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47ab8b36963-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 main.f174db22.js Show response
spk.support24-customers.de/static/js/ 316 KB
95 KB 38ms
37ms Script
application/javascript 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/static/js/main.f174db22.js
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/?tkn=a087
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51d7d4a518670e90951ebdff9802c8809886af641ebb9529e81dd9060bc66798

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spk.support24-customers.de/?tkn=a087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Jul 2022 19:47:22 GMT
server: cloudflare
age: 1176
etag: W/"62cc7e4a-4f13a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=STb%2B7TWG6%2FVASOlkSgxbTM737C7GEh2h2nlfeVRO9PcOJuh08skqqm%2BYwjnf8EnkwjhJ1Udu0lBMbo%2FO0GgtSOw8vzR2A85G22V8PNEQkjpsXOTgGoIHiND9%2FJjkT5Ir1ryoNpmmbYvDoR2bebkMcgGv0tKnqlFMPw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47ab8b66963-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 main.f6f53d17.css
spk.support24-customers.de/static/css/ 4 KB
1 KB 37ms
36ms Stylesheet
text/css 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/static/css/main.f6f53d17.css
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/?tkn=a087
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa809558f65f4392975344302394e8c46b85a834721e5f119ef5e2b4ae6b206e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spk.support24-customers.de/?tkn=a087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Jul 2022 19:47:22 GMT
server: cloudflare
age: 1176
etag: W/"62cc7e4a-e46"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15k5MOvnp0mkL%2B3Hre8aoBTovhsOiG2dzeqfSEw2HU4ZQ2Sj86kLOhsidguWPAeijBB%2BiDguxWxBw0%2Fko8hJ0Iy%2FsJtDX2OCJmx1l70OfsjFx%2BILqClVFd4XC7mcTpFnzcrt2reVFofYV0K2ADd7pjHLfIcrD%2BKKMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47ab8b56963-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 login Show response
spk.support24-customers.de/backend/phishing-api/ 146 B
804 B 519ms
518ms XHR
application/json 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://spk.support24-customers.de/backend/phishing-api/login

Requested by

Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/static/js/main.f174db22.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7c3533f4cacbfdd2635862960b6cd1393ea1d3454f27439cb2ef790a92eeb9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://spk.support24-customers.de/?tkn=a087
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
server: cloudflare
x-frame-options: DENY
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eKRtouTfKOFGycWW%2FckhjFylqFagUXf2zoY0esgQPkAph%2FVieKAJnkXZaqseneOPsM3IOePuGgeturluaYomoMGw7S0XfrogIDVklpO5FfS3WA9gtYL9SKmV83URlhxuRBupe1sqDw4AaWo9v9Rr7wC4jUJgzL3ypA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: xsrf-token
cache-control: no-cache, no-store, max-age=0, must-revalidate
cf-ray: 7358f47b58159a18-FRA
access-control-allow-headers: authorization, content-type, xsrf-token, X-TenantID, Payment-Code
expires: 0

GET
H3 200 spk-logo.e094517258e696592c79a6d2e65c4e55.svg
spk.support24-customers.de/static/media/ 22 KB
9 KB 151ms
151ms Image
image/svg+xml 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spk.support24-customers.de/static/media/spk-logo.e094517258e696592c79a6d2e65c4e55.svg
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/?tkn=a087
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 484992c25ce8dc0d0b2b0a0f11b6de4ea5e158c4762497497b007476e0c721d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spk.support24-customers.de/?tkn=a087
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 11 Jul 2022 19:47:17 GMT
server: cloudflare
etag: W/"62cc7e45-58e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xWDfu8TTdwiw8erV2jLtv4Tn2uxq3m6XrBs%2Fw%2BxtjFNfjQSbmFQ4vameW9NOGG5jR73Hfvs4w8GJhEWzpsVJKqbQgxdH5BU6%2F0cFmewVddP6nK0jvMMYFjH0vXXXnlzv4OKoWNNJfloPQrob6savFTE9%2BPQjgPs5wA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47b782a9a18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 search.f3632f79a9da4aeb24e0.svg
spk.support24-customers.de/static/media/ 484 B
856 B 107ms
106ms Image
image/svg+xml 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spk.support24-customers.de/static/media/search.f3632f79a9da4aeb24e0.svg
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/static/css/main.f6f53d17.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2805c3dfeb6ca4c6e35ee20edf47c6f6359dd1ec797ccc5ca04ca566d68fc95c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spk.support24-customers.de/static/css/main.f6f53d17.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 11 Jul 2022 19:47:18 GMT
server: cloudflare
etag: W/"62cc7e46-1e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qy1HK%2FJbbh7SGsrzoj74bqt%2FSCj49DLPghjq2%2FDFYUZenRRjWioVdAfI1gTDU4FDFFwXim%2FjzY3rANjr%2ByHGccaOWOSaTycueplaqbDBCvLvR%2FfF0HC35iriLImQDBrz6L2vVjZ15A87QSARpnFf7dDeJGHexzot3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47b782b9a18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 Sparkasse_web_Rg.woff
spk.support24-customers.de/fonts/ 41 KB
41 KB 142ms
142ms Font
application/font-woff 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/fonts/Sparkasse_web_Rg.woff
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/css/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451

Request headers

Referer: https://spk.support24-customers.de/css/style.css
Origin: https://spk.support24-customers.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 11 Jul 2022 19:47:26 GMT
server: cloudflare
etag: W/"62cc7e4e-a200"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0MCPQCAg%2FsrbMEThAJBhjlBNAlXLftR04d5XNZQa0QJm%2Ff8rSp2MeARrP%2F5cYrGoZ%2BqMo7CpZEDGXmHGql%2Fw9xp3UbF15nSsm0%2BFyznsA56g6%2BqMms8no94nlyNyxf38NYSeQ8hpD8dcS6QkqPY2DoLiLv%2FOymc6tQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47b782e9a18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 pictos-if.woff
spk.support24-customers.de/fonts/ 139 KB
140 KB 246ms
245ms Font
application/font-woff 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/fonts/pictos-if.woff
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/css/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84798913afc7420e1087ff7c0a0c5b39937ddd430b67bf96561ffbaed9e77b14

Request headers

Referer: https://spk.support24-customers.de/css/style.css
Origin: https://spk.support24-customers.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 11 Jul 2022 19:47:27 GMT
server: cloudflare
etag: W/"62cc7e4f-22d74"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vk4iy%2F%2FySMkEz2gQ%2BxuL5yP%2BQPgRDfa%2BjAZSEc%2FL1G20QCJbpaTdr%2B7X%2F98Rm1uOA2jCuWyT54nJeR2JhYro5JEEoKk1Z3t4%2F54SYpK3jG4xSyRTVwJiY2JuQUOpWCF1lEvHnV3jebXzDPr7bWWincRiUtDUrZzpLg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47b78309a18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 Sparkasse_web_Bd.woff
spk.support24-customers.de/fonts/ 36 KB
37 KB 156ms
156ms Font
application/font-woff 2606:4700:3033::6815:159
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spk.support24-customers.de/fonts/Sparkasse_web_Bd.woff
Requested by: Host: spk.support24-customers.de
URL: https://spk.support24-customers.de/css/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:159 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002

Request headers

Referer: https://spk.support24-customers.de/css/style.css
Origin: https://spk.support24-customers.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:18:55 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 11 Jul 2022 19:47:26 GMT
server: cloudflare
etag: W/"62cc7e4e-901c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FBIMI9spwkt4sXvonipgQyE7aP40JS4LsSh52ogzm%2F7J3ZdRJjDEP%2FDm2BojC555iIcNjwW9gIL7CE8ITHtt%2FbGn5GIT6lupt0PDVglhWPmkmRKTrZ9yBlg%2FAv2lty6nWyhrLhMFWVSDzpj5AHhHdOa77Vjqin27sQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7358f47b78339a18-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spk.support24-customers.de
2606:4700:3033::6815:159
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451
2805c3dfeb6ca4c6e35ee20edf47c6f6359dd1ec797ccc5ca04ca566d68fc95c
484992c25ce8dc0d0b2b0a0f11b6de4ea5e158c4762497497b007476e0c721d8
51d7d4a518670e90951ebdff9802c8809886af641ebb9529e81dd9060bc66798
84798913afc7420e1087ff7c0a0c5b39937ddd430b67bf96561ffbaed9e77b14
91e2ddb27aa45076fc969c83720a61376c13512afc9a8cbfc4c2c135d16f8b9b
9eddcb059236ed4f4f7fce2060dcfa34eae43c11edfd3f2c17a51eecb144b2f2
aa809558f65f4392975344302394e8c46b85a834721e5f119ef5e2b4ae6b206e
c7c3533f4cacbfdd2635862960b6cd1393ea1d3454f27439cb2ef790a92eeb9a
e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002

spk.support24-customers.de Open in urlscan Pro 2606:4700:3033::6815:159 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

485 kBTransfer

1996 kBSize

0 Cookies

8 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

spk.support24-customers.de Open in urlscan Pro
2606:4700:3033::6815:159 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

485 kB
Transfer

1996 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!