sso.alpenbank.at
Open in
urlscan Pro
217.13.188.163
Malicious Activity!
Public Scan
Effective URL: https://sso.alpenbank.at/login/
Submission: On September 10 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by DigiCert EV RSA CA G2 on July 8th 2020. Valid for: a year.
This is the only time sso.alpenbank.at was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Raiffeisen Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 217.13.188.210 217.13.188.210 | 24864 (R-IT-AS) (R-IT-AS) | |
1 24 | 217.13.188.163 217.13.188.163 | 24864 (R-IT-AS) (R-IT-AS) | |
3 | 193.110.129.205 193.110.129.205 | 24708 (GRZ-) (GRZ-) | |
27 | 3 |
ASN24864 (R-IT-AS, AT)
PTR: elba.raiffeisen.at
mein.elba.alpenbank.at |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
alpenbank.at
2 redirects
mein.elba.alpenbank.at sso.alpenbank.at |
842 KB |
3 |
raiffeisen.at
info.raiffeisen.at |
3 KB |
27 | 2 |
Domain | Requested by | |
---|---|---|
24 | sso.alpenbank.at |
1 redirects
mein.elba.alpenbank.at
sso.alpenbank.at |
3 | info.raiffeisen.at |
sso.alpenbank.at
|
2 | mein.elba.alpenbank.at | 1 redirects |
27 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
raiffeisen.at |
Subject Issuer | Validity | Valid | |
---|---|---|---|
mein.elba.alpenbank.at DigiCert EV RSA CA G2 |
2020-07-08 - 2021-09-27 |
a year | crt.sh |
sso.alpenbank.at DigiCert EV RSA CA G2 |
2020-07-08 - 2021-09-27 |
a year | crt.sh |
info.raiffeisen.at DigiCert Global CA G2 |
2020-06-12 - 2022-09-13 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://sso.alpenbank.at/login/
Frame ID: 50D1CF4AEBB07D9C4A1CBFE91CCCA7B5
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
Login – Alpenbank AktiengesellschaftPage URL History Show full URLs
-
https://mein.elba.alpenbank.at/
HTTP 302
https://mein.elba.alpenbank.at/pfp-widgetsystem/ Page URL
- https://sso.alpenbank.at/as/authorization.oauth2?response_type=code&client_id=DRB-PFP-RAB-WEB&redirec... Page URL
-
https://sso.alpenbank.at/start/?bankengruppe=rab
HTTP 303
https://sso.alpenbank.at/login/ Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- \bangular.{0,32}\.js
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Hotline
Search URL Search Domain Scan URL
Title: FAQ
Search URL Search Domain Scan URL
Title: Demo
Search URL Search Domain Scan URL
Title: Site notice
Search URL Search Domain Scan URL
Title: Conditions of use
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://mein.elba.alpenbank.at/
HTTP 302
https://mein.elba.alpenbank.at/pfp-widgetsystem/ Page URL
- https://sso.alpenbank.at/as/authorization.oauth2?response_type=code&client_id=DRB-PFP-RAB-WEB&redirect_uri=https%3A%2F%2Fmein.elba.alpenbank.at%2Fpa%2Foidc%2Fcb&state=eyJ6aXAiOiJERUYiLCJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZG8iLCJzdWZmaXgiOiJyTGdUSUIuMTYzMTUyMTQ4NiJ9..SYSlZ_tl7D_pqQ7HdDNKQw.o1cJuicTrPpfYeGMihFSuVtRJbzMZoyLc1XNA4CFhezfjpKRkk7KwM7l_oJVNmwtEtiYUxx1FiqvWEiS53VTHYn9svQGiyAHUVD_5suPyxEPTt_osNO---wBUbMF6GS6quazNZMCAwq4Y-I-LgBy7g.lz_bVHrSYqq0gMbs__htU6FP0OmxFt1hjwgHZuQ5V9c&nonce=1MrY1o35_xxkMj2dIt1Qhpx9swmkEBly7uXI049gtho&scope=openid%20profile%20address%20email%20phone&vnd_pi_requested_resource=https%3A%2F%2Fmein.elba.alpenbank.at%2Fpfp-widgetsystem%2F&vnd_pi_application_name=DRB-PFP-RAB-Applications-WEB Page URL
-
https://sso.alpenbank.at/start/?bankengruppe=rab
HTTP 303
https://sso.alpenbank.at/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://mein.elba.alpenbank.at/ HTTP 302
- https://mein.elba.alpenbank.at/pfp-widgetsystem/
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
mein.elba.alpenbank.at/pfp-widgetsystem/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
authorization.oauth2
sso.alpenbank.at/as/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
sso.alpenbank.at/login/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
libs-87dc1b1527.js
sso.alpenbank.at/login/js/ |
2 MB 480 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts-2deb7edad1.js
sso.alpenbank.at/login/js/ |
142 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bundles-metadata-8373daf52d.js
sso.alpenbank.at/login/js/ |
518 B 441 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
libs-f423ea7dec.css
sso.alpenbank.at/login/css/ |
20 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config
sso.alpenbank.at/kunde-login-ui-services/rest/meta/ |
917 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
context
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/config/ |
390 B 687 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wa.js
info.raiffeisen.at/t/script/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular_i18n_de-9438ac8b9d.js
sso.alpenbank.at/login/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
identify
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/ |
152 B 448 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rab.css
sso.alpenbank.at/login/css/ |
334 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translations_en_rab.js
sso.alpenbank.at/login/js/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
translations_en_rab-libs.js
sso.alpenbank.at/login/js/ |
4 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/config/urls/ |
773 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/emergencies/rab/ |
0 233 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
schedule
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/maintenance/ |
0 233 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular.woff
sso.alpenbank.at/login/assets/fonts/open-sans/Regular/ |
62 KB 62 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
drb-iconfont.woff
sso.alpenbank.at/login/assets/fonts/drb-iconfont/ |
124 KB 125 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Semibold.woff
sso.alpenbank.at/login/assets/fonts/open-sans/Semibold/ |
68 KB 68 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
info.raiffeisen.at/t/track/3939373332/ |
43 B 488 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
sso.alpenbank.at/login/assets/images/themes/rab/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default-kunde.svg
sso.alpenbank.at/login/assets/images/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/config/mandanten/ |
86 B 382 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
info.raiffeisen.at/t/track/3939373332/ |
43 B 488 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
schedule
sso.alpenbank.at/api/quer-kunde-login/kunde-login-ui-services/rest/maintenance/ |
0 233 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Raiffeisen Bank (Banking)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster object| SourceMap function| _typeof boolean| windowIsDefined function| $ function| jQuery object| angular function| Inputmask function| Url function| Cookies object| log4javascript function| moment function| _ object| ES6Promise object| JSON3 function| StackFrame function| StackTraceGPS object| StackGenerator object| ErrorStackParser object| StackTrace object| _internal function| RapjsMessage function| RapjsLogContext function| Slider object| PerfectScrollbar object| Ps object| Highcharts function| sha256 function| sha224 object| showdown object| ngShowdown object| _wa object| batchTmp6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mein.elba.alpenbank.at/ | Name: nonce.rLgTIB.1631521486 Value: 2bbee366-2521-461c-a0f0-4ef00ab17f76 |
|
sso.alpenbank.at/ | Name: PF Value: cfDDmbAFCQTb5jIsM33ZZHVr0mXhU9TaRPGVHOvlxLWF |
|
sso.alpenbank.at/ | Name: LP.login_session Value: "_gsZijHlnsy1Fr9z6CRq4ITy_e7F7ZyGiy0UEq65pNiO0S7OLtjQevL7U9zXrBglLM7D1cURpJPPg6y25uQd3Zy175dZD3nFEzBa-d4N4BBeAWbuNYrC8wjRoXfKUilPtc-6dDv2g_g0iHd4tEfge4_jWp0A0mBebtgJ7EZvisY=" |
|
sso.alpenbank.at/ | Name: 1b30f32ec39a19f41a9ce33b0116b81f Value: f8c183de2a31de133d65249fcb728372 |
|
.alpenbank.at/ | Name: WATRC Value: 61A3A9D0-826F-4290-B246-CD97E7978439 |
|
.alpenbank.at/ | Name: WANV Value: 414065E7-6267-4F05-AAE8-9379EC15164D |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
info.raiffeisen.at
mein.elba.alpenbank.at
sso.alpenbank.at
193.110.129.205
217.13.188.163
217.13.188.210
0edeaf7547901479467358d38ac026b4a609a751f5ffc3f68892bb93fa986ee2
0eebbd534ae81b252a9167f524485360726e1f726eefe4858790b004e6bf4424
1203a6704005b40b6080923d0939ebab0c89c1d8dd8866a1aef4eecee540c459
1884298feb141aef339390c404abb38ffe06eef737a56c8c000e513ca975b272
2a31b6a3a41c999ed99a7daa47fea36a63b55d312b684cdf37c5b736ea8fbab3
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
5d337913326e7946c800a4b016dac7c8e87655dfd1942419722047b32bd6f7e2
5fca1ba7675b18c0927ee8c50a71387fa222d98a9855750d0026eacb6b2ed57b
65881060bb76748169632e44946f7d68a28719d5f65f09d64ef91332073632a5
6c2ed8fc13478bb9f816a19ab2dc95ffd83846731d0aac687c907bcaf357a33b
6ec1f05f0912868bc322dd7d9cda61d5290220df779e8413a77d85b136a9ca97
70073180356c061ff28f9a399683900afc385529ec7269209d8be7d9fc0bfbae
79023d40ea05870050de52cb4a93cd583097de99fefe4aaba8fd8cb5e5486c9b
7ec9e1364bb424cbe45537e6597cc2bf0b3c73977dc796bd09dd6daad5141786
87510c5b8fb8f84f1b47ce339c3e0cc2c07cfceeca4de3132aadcbbf5a242970
a9f7ec5d26ccf1e4e03cf39b7338aa76f0677e2b2faf76f00d1134652a287032
b011c18860ef334ac618f08b2c50677e6b8554141d7cab198326c31a7690df90
b0390aa3e137e3e49d7d6ed5d86c208fec1dd45ff8a56836c3f86c2e32cd2d7a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4a68bab8c114a582b91b000278d0f5246e744a355b6e3f67507c21ed9b4c615
f18ba5cf3f90bef34406ea52eebce55ed6fc5190e96a50be7b07d0983f2d10af