sparkasseid.info Open in urlscan Pro
185.185.69.181 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sparkasseid.info/
Effective URL:
https://sparkasseid.info/
Submission: On November 06 via api (November 6th 2024, 1:13:49 pm UTC) from NL — Scanned from NL

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 23 HTTP transactions. The main IP is 185.185.69.181, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is sparkasseid.info.
TLS certificate: Issued by R10 on November 6th 2024. Valid for: 3 months.

This is the only time sparkasseid.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

	IP Address	AS Autonomous System
16	185.185.69.181 185.185.69.181	35278 (SPRINTHOST) (SPRINTHOST)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
3	142.250.186.100 142.250.186.100	15169 (GOOGLE) (GOOGLE)
1	216.58.212.163 216.58.212.163	15169 (GOOGLE) (GOOGLE)
1	104.21.20.107 104.21.20.107	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	6

16 185.185.69.181 (Russian Federation)

ASN35278 (SPRINTHOST, RU)

sparkasseid.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

anal-lytics.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.100 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.163 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f163.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.20.107 (None, )

ASN13335 (CLOUDFLARENET, US)

api.inetstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	sparkasseid.info sparkasseid.info	931 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	969 B
1	inetstatic.com api.inetstatic.com	858 B
1	gstatic.com www.gstatic.com	217 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 791	31 KB
1	anal-lytics.site anal-lytics.site	665 B
23	6

	Domain	Requested by
16	sparkasseid.info	sparkasseid.info
3	www.google.com	sparkasseid.info www.gstatic.com
1	api.inetstatic.com	sparkasseid.info
1	www.gstatic.com	www.google.com
1	code.jquery.com	sparkasseid.info
1	anal-lytics.site	sparkasseid.info
23	6

This site contains no links.

Subject Issuer	Validity	Valid
sparkasseid.info R10	`2024-11-06` - `2025-02-04`	3 months	crt.sh
anal-lytics.site WE1	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
inetstatic.com WE1	`2024-09-25` - `2024-12-24`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://sparkasseid.info/
Frame ID: 3A87C9ED56BA8620EF187A8237C59FA9
Requests: 21 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2&co=aHR0cHM6Ly9zcGFya2Fzc2VpZC5pbmZvOjQ0Mw..&hl=nl&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=iypmli28xj6q
Frame ID: 344B25D934AFAC13FE46CD31F0F87A38
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=nl&v=-ZG7BC9TxCVEbzIO2m429usb&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2
Frame ID: 21D27D9A75D4DB778E89AAF699B55BCA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Verifizieren Sie Ihre Echtheit

Page URL History Show full URLs

http://sparkasseid.info/ HTTP 307
https://sparkasseid.info/ Page URL

Detected technologies

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"
/recaptcha/api\.js

Page Statistics

23
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

1181 kB
Transfer

4308 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sparkasseid.info/ HTTP 307
https://sparkasseid.info/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sparkasseid.info/
Redirect Chain

http://sparkasseid.info/
https://sparkasseid.info/

8 KB
3 KB

342ms
85ms

Document
text/html

185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PHP/7.4.33 PleskLin
Resource Hash: 9b430d03b29fd0cee8fd51c4ce9c09ece8e013a1403900e72e11019bad53e8e3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 2449
content-type: text/html; charset=UTF-8
date: Wed, 06 Nov 2024 13:27:07 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/7.4.33 PleskLin

Redirect headers

Location: https://sparkasseid.info/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 erv1vOpbgRElhRgF Show response
anal-lytics.site/pixel/ 0
665 B 372ms
330ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://anal-lytics.site/pixel/erv1vOpbgRElhRgF
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33, PleskLin
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

cache-control: max-age=300
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0twThTvAMvMvL4WxyVsaUjp3bdhzE5oAigdLC%2F7GmGaXupGh40hURV7jVmvTSh70kYoaB3RNAx0ukONDVX%2BGTPl7uwk8nMJi938lp8DcSdkHwumvrCVdXNDza8wP0RM0nyWS"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de557b38c490a6b-AMS
expires: Wed, 06 Nov 2024 13:32:07 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=16560&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4136&recv_bytes=4376&delivery_rate=654&cwnd=12000&unsent_bytes=0&cid=21ccfe55da56022a&ts=336&x=1", cfHdrFlush;dur=0
content-length: 0
date: Wed, 06 Nov 2024 13:13:44 GMT
content-type: application/javascript
x-powered-by: PHP/7.4.33, PleskLin
server: cloudflare

GET
H2 200 app.css
sparkasseid.info/css/ 2 MB
153 KB 214ms
198ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/app.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: ee3a3ead6613706b3ed572ffc5dfda04d0dbd23ee3ca531b0667bce2fc13cf66

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1552-1aa935"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:22 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 opsm.css
sparkasseid.info/css/ 520 KB
59 KB 444ms
428ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/opsm.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 63e72211b14fd60bbd0297df351621ff058717b129732429ce12c0db6d19144b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1552-821ce"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:22 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 opttan.css
sparkasseid.info/css/ 4 KB
1 KB 498ms
482ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/opttan.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: c6ce7c8d3cdd2175bfb851d5fb45fe42b004ce4832f2b950db31b8fe5cf9cf6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1550-11f8"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 perf-meter.css
sparkasseid.info/css/ 398 B
438 B 493ms
484ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/perf-meter.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: f008c09173b9230f184fdbcf0fcbf3c4fc8daf1bea6c41b3614f5a3a11e9d376

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

x-powered-by: PleskLin
content-encoding: gzip
etag: "18e-5eb186df3f400-gzip"
x-accel-version: 0.01
accept-ranges: bytes
content-length: 231
date: Wed, 06 Nov 2024 13:27:07 GMT
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 ospm_custom.css
sparkasseid.info/css/ 18 KB
3 KB 494ms
484ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/ospm_custom.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d8ad9ac7b82f1b3feb913e78d5177210c73131d217d6db6e7a18c6fb91e582e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1550-474a"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-ui.css
sparkasseid.info/css/ 35 KB
8 KB 498ms
489ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/jquery-ui.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 5af098721b219c4801711bad963757a6cbac2aa2d4cfcde9ee7aec943219c066

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1550-8d18"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-3.6.0.js Show response
sparkasseid.info/js/ 282 KB
78 KB 497ms
488ms Script
application/javascript 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/js/jquery-3.6.0.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1550-46744"
content-type: application/javascript
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-ui.js Show response
sparkasseid.info/js/ 517 KB
113 KB 550ms
541ms Script
application/javascript 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/js/jquery-ui.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: b0fb363c54d6747d3609153c3cf96424e27e806162de5f7083e7fc37fd540833

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b155a-8158c"
content-type: application/javascript
last-modified: Sat, 15 Oct 2022 20:17:30 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 select2.min.css
sparkasseid.info/css/ 16 KB
2 KB 489ms
484ms Stylesheet
text/css 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/css/select2.min.css
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b1550-3f88"
content-type: text/css
last-modified: Sat, 15 Oct 2022 20:17:20 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 select2.min.js Show response
sparkasseid.info/js/ 72 KB
18 KB 738ms
733ms Script
application/javascript 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/js/select2.min.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d7bf5175d05e81bec066f1e5b222d0ca71f1f68311123a9c28271f4be0e01e55

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:07 GMT
etag: W/"634b155a-11efb"
content-type: application/javascript
last-modified: Sat, 15 Oct 2022 20:17:30 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-3.6.1.min.js Show response
code.jquery.com/ 88 KB
31 KB 73ms
17ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.1.min.js
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/

Response headers

content-encoding: gzip
etag: W/"28feccc0-15e40"
age: 1913062
x-cache: HIT, HIT
date: Wed, 06 Nov 2024 13:13:44 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-cache-hits: 84, 15551
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-served-by: cache-lga13629-LGA, cache-bru1480068-BRU
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1730898824.265592,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30957
server: nginx

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
969 B 102ms
42ms Script
text/javascript 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: sparkasseid.info
URL: https://sparkasseid.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

ESF /

Resource Hash

091373002b74df1394f392ab2c903370ca790c7f50a0e119b2be771f3735c9ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Wed, 06 Nov 2024 13:13:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Wed, 06 Nov 2024 13:13:45 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 loading-spk.gif
sparkasseid.info/images/ 415 KB
415 KB 651ms
648ms Image
image/gif 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sparkasseid.info/images/loading-spk.gif
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: a1e3d1365b06e4e233058ecc48c69421c44303a81e9683a57a9644fca621a11a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

etag: "64bdf00e-67b89"
accept-ranges: bytes
content-length: 424841
date: Wed, 06 Nov 2024 13:27:07 GMT
content-type: image/gif
last-modified: Mon, 24 Jul 2023 03:29:18 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 404 Sparkasse_web_Bd.woff
sparkasseid.info/fonts/ 0
0 178ms
177ms Font
text/html 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/fonts/Sparkasse_web_Bd.woff
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/css/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/css/app.css

Response headers

content-encoding: br
date: Wed, 06 Nov 2024 13:27:08 GMT
etag: W/"328-61453c9d36247"
content-type: text/html
last-modified: Sat, 23 Mar 2024 13:19:21 GMT
server: nginx

GET
H2 200 Sparkasse_web_Rg.woff
sparkasseid.info/fonts/ 24 KB
25 KB 151ms
150ms Font
font/woff 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/fonts/Sparkasse_web_Rg.woff
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/css/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 43a2c75ca73d8c1101ff7ae617e6dbc6934e8aa1cd72d64ce50908ac297156cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/css/app.css

Response headers

etag: "6410c12c-61f4"
accept-ranges: bytes
content-length: 25076
date: Wed, 06 Nov 2024 13:27:08 GMT
content-type: font/woff
last-modified: Tue, 14 Mar 2023 18:47:08 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 recaptcha__nl.js Show response
www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/ 546 KB
217 KB 59ms
24ms Script
text/javascript 216.58.212.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__nl.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

2f1a73bf3fe63785c5fcc5f80841eb731cea794b18c98696f8c906a31c6f21e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/

Response headers

content-encoding: gzip
age: 14846
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 09:06:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 09:06:19 GMT
last-modified: Tue, 22 Oct 2024 00:01:33 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 221782
x-xss-protection: 0
server: sffe

GET
H2 200 Sparkasse_web_Bd.ttf
sparkasseid.info/fonts/ 50 KB
50 KB 100ms
97ms Font
font/ttf 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/fonts/Sparkasse_web_Bd.ttf
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/css/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 2531cb7acd60ec49f05916ca751a3bbf990cb5c674cdd9265086c38788771959

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://sparkasseid.info
Referer: https://sparkasseid.info/css/app.css

Response headers

etag: "6410c1ce-c704"
accept-ranges: bytes
content-length: 50948
date: Wed, 06 Nov 2024 13:27:08 GMT
content-type: font/ttf
last-modified: Tue, 14 Mar 2023 18:49:50 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 344B 0
0 159ms
57ms Document
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2&co=aHR0cHM6Ly9zcGFya2Fzc2VpZC5pbmZvOjQ0Mw..&hl=nl&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=iypmli28xj6q

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kOmreexKtjEURVlA_ZktyQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sparkasseid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-kOmreexKtjEURVlA_ZktyQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Nov 2024 13:13:45 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 favicon.ico
sparkasseid.info/images/ 4 KB
4 KB 76ms
74ms Other
image/vnd.microsoft.icon 185.185.69.181
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://sparkasseid.info/images/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.185.69.181 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: d527da1e5069fa2d735eabd5d481247a8157ef10c550255c484026af3562970d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

etag: "64bdf7a6-10be"
accept-ranges: bytes
content-length: 4286
date: Wed, 06 Nov 2024 13:27:09 GMT
content-type: image/vnd.microsoft.icon
last-modified: Mon, 24 Jul 2023 04:01:42 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 script.js Show response
api.inetstatic.com/tracking/ 137 B
858 B 676ms
627ms Script
text/javascript 104.21.20.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.inetstatic.com/tracking/script.js?referrer=https://sparkasseid.info/
Requested by: Host: sparkasseid.info
URL: https://sparkasseid.info/js/jquery-ui.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.20.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.1
Resource Hash: 602a881febdd0811160e14cadb7cb2d31381d10ea9776062a8772e2073f96dfc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://sparkasseid.info/

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H6mxvyd6uAh4u9KVOshGu%2Fgvs0XieVpy4McFygZA4U%2FE%2FBo5Ec4JaqCX7m6g%2Fm%2BOY1B8WK0BE%2FjezKlkzGXu3en6ohYKbbRnT0JSgSCLofPFluPnmADdW6XSSCjPpagqaWo1JIo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=15632&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4152&recv_bytes=4397&delivery_rate=639&cwnd=12000&unsent_bytes=0&cid=28def0c80f9a01be&ts=640&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 13:13:46 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With,content-type
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8de557bdeff666e7-AMS
access-control-allow-origin: https://sparkasseid.info
x-powered-by: PHP/8.2.1
server: cloudflare

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame 21D2 0
0 72ms
51ms Document
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=nl&v=-ZG7BC9TxCVEbzIO2m429usb&k=6LcmeVkoAAAAAJHt47ZtwZlAFgpRRt89omMXUmh2

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-C4MXTjC967QKF3m2z3K5xQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sparkasseid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-C4MXTjC967QKF3m2z3K5xQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Nov 2024 13:13:46 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sparkasseid.info/	1970-01-21 00:48:58	Name: PHPREFS Value: full

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sparkasseid.info/fonts/Sparkasse_web_Bd.woff Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anal-lytics.site
api.inetstatic.com
code.jquery.com
sparkasseid.info
www.google.com
www.gstatic.com
104.21.20.107
142.250.186.100
185.185.69.181
188.114.97.3
216.58.212.163
2a04:4e42:400::649
091373002b74df1394f392ab2c903370ca790c7f50a0e119b2be771f3735c9ac
1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239
2531cb7acd60ec49f05916ca751a3bbf990cb5c674cdd9265086c38788771959
2f1a73bf3fe63785c5fcc5f80841eb731cea794b18c98696f8c906a31c6f21e2
43a2c75ca73d8c1101ff7ae617e6dbc6934e8aa1cd72d64ce50908ac297156cb
5af098721b219c4801711bad963757a6cbac2aa2d4cfcde9ee7aec943219c066
602a881febdd0811160e14cadb7cb2d31381d10ea9776062a8772e2073f96dfc
63e72211b14fd60bbd0297df351621ff058717b129732429ce12c0db6d19144b
9b430d03b29fd0cee8fd51c4ce9c09ece8e013a1403900e72e11019bad53e8e3
a1e3d1365b06e4e233058ecc48c69421c44303a81e9683a57a9644fca621a11a
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b0fb363c54d6747d3609153c3cf96424e27e806162de5f7083e7fc37fd540833
c6ce7c8d3cdd2175bfb851d5fb45fe42b004ce4832f2b950db31b8fe5cf9cf6a
cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c
d527da1e5069fa2d735eabd5d481247a8157ef10c550255c484026af3562970d
d7bf5175d05e81bec066f1e5b222d0ca71f1f68311123a9c28271f4be0e01e55
d8ad9ac7b82f1b3feb913e78d5177210c73131d217d6db6e7a18c6fb91e582e9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3a3ead6613706b3ed572ffc5dfda04d0dbd23ee3ca531b0667bce2fc13cf66
f008c09173b9230f184fdbcf0fcbf3c4fc8daf1bea6c41b3614f5a3a11e9d376

sparkasseid.info Open in urlscan Pro 185.185.69.181 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

100 %HTTPS

17 %IPv6

6 Domains

6 Subdomains

6 IPs

4 Countries

1181 kBTransfer

4308 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

sparkasseid.info Open in urlscan Pro
185.185.69.181 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

1181 kB
Transfer

4308 kB
Size

1
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!