crisstino.wonstasite.com Open in urlscan Pro
34.76.112.83 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://pandithakash.com/magie/ander.html
Effective URL:
https://crisstino.wonstasite.com/ykn/bkdd/
Submission: On August 12 via api (August 12th 2022, 2:26:14 am UTC) from CH — Scanned from DE

Summary HTTP 2987 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 2987 HTTP transactions. The main IP is 34.76.112.83, located in Brussels, Belgium and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is crisstino.wonstasite.com.
TLS certificate: Issued by R3 on July 28th 2022. Valid for: 3 months.

This is the only time crisstino.wonstasite.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	162.241.118.12 162.241.118.12	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2001:8d8:100f... 2001:8d8:100f:f000::200	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1 9	34.76.112.83 34.76.112.83	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	52.211.150.237 52.211.150.237	16509 (AMAZON-02) (AMAZON-02)
2987	5

1 162.241.118.12 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-118-12.unifiedlayer.com

pandithakash.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:8d8:100f:f000::200 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

bejamin.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 34.76.112.83 (Brussels, Belgium) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 83.112.76.34.bc.googleusercontent.com

crisstino.wonstasite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.211.150.237 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-150-237.eu-west-1.compute.amazonaws.com

res.ihre.dkb.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	wonstasite.com 1 redirects crisstino.wonstasite.com	186 KB
1	dkb.de res.ihre.dkb.de — Cisco Umbrella Rank: 221226 dkb.de Failed	22 KB
1	bejamin.fr bejamin.fr	338 B
1	pandithakash.com pandithakash.com	210 B
0	Failed function sub() { [native code] }. Failed
2987	5

	Domain	Requested by
9	crisstino.wonstasite.com	1 redirects crisstino.wonstasite.com
1	res.ihre.dkb.de	crisstino.wonstasite.com
1	bejamin.fr
1	pandithakash.com
0	dkb.de Failed	crisstino.wonstasite.com
0	mbckjcfnjmoiinpgddefodcighgikkgn Failed	crisstino.wonstasite.com
2987	6

This site contains links to these domains. Also see Links.

Domain
finanzwissen.dkb.de
information.dkb.de
treuhand.dkb.de
www.facebook.com
www.instagram.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.xing.com
www.das-kann-bank.de
fragen.dkb.de

Subject Issuer	Validity	Valid
pandithakash.com R3	`2022-07-30` - `2022-10-28`	3 months	crt.sh
*.bejamin.fr Encryption Everywhere DV TLS CA - G1	`2022-07-19` - `2023-07-19`	a year	crt.sh
crisstino.wonstasite.com R3	`2022-07-28` - `2022-10-26`	3 months	crt.sh
ihre.dkb.de DKB CA 1O1	`2022-03-07` - `2023-03-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://crisstino.wonstasite.com/ykn/bkdd/
Frame ID: 0D67DFAB1860801C0837F3103B4A7A94
Requests: 3000 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DKB - Deutsche Kreditbank AG - Internet Banking

Page URL History Show full URLs

https://pandithakash.com/magie/ander.html Page URL
https://bejamin.fr/binnt-1.html Page URL
https://crisstino.wonstasite.com/ykn/bkdd HTTP 301
http://crisstino.wonstasite.com/ykn/bkdd/ HTTP 307
https://crisstino.wonstasite.com/ykn/bkdd/ Page URL

Page Statistics

2987
Requests

0 %
HTTPS

25 %
IPv6

5
Domains

6
Subdomains

5
IPs

4
Countries

209 kB
Transfer

1239 kB
Size

1
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://finanzwissen.dkb.de/
Title: Finanzwissen

Search URL Search Domain Scan URL

URL: https://information.dkb.de/interaction/liveRcp/DKB_SPC6_Login?a=UpdateStatus&p=859753549&st=2&r=https%3A%2F%2Fwww.dkb.de%2Finfo%2Fkontowechselservice
Title: Konto wechsel dich: einfach, schnell und flexibel Kontowechsel ohne Zettelwirtschaft? Das geht. Ziehen Sie Ihr Girokonto in weniger als 10 Minuten zu uns um. Ob Handy, Miete, Strom – Ihre Zahlungspartner informieren wir für Sie.

Search URL Search Domain Scan URL

URL: https://treuhand.dkb.de/thk/?referer=vwpf
Title: Zur DKB-Verwalterplattform

Search URL Search Domain Scan URL

URL: https://treuhand.dkb.de/thk/?referer=thpf
Title: Zur DKB-Treuhänderplattform

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Deutsche.Kreditbank
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/dkb.de/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.twitter.com/dkb_de
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/DeutscheKreditbankAG
Title: Youtube

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/dkb
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.xing.com/companies/deutschekreditbankag
Title: Xing

Search URL Search Domain Scan URL

URL: https://www.das-kann-bank.de/
Title: Das kann Bank

Search URL Search Domain Scan URL

URL: https://fragen.dkb.de/
Title: Fragen & Antworten

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pandithakash.com/magie/ander.html Page URL
https://bejamin.fr/binnt-1.html Page URL
https://crisstino.wonstasite.com/ykn/bkdd HTTP 301
http://crisstino.wonstasite.com/ykn/bkdd/ HTTP 307
https://crisstino.wonstasite.com/ykn/bkdd/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2987 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 ander.html Show response
pandithakash.com/magie/ 77 B
210 B 794ms
145ms Document
text/html 162.241.118.12
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://pandithakash.com/magie/ander.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.241.118.12 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-118-12.unifiedlayer.com
Software: Apache /
Resource Hash: 3d7159563751d980dbfd8e534f54b21ee8b99452207d75e5c3b13e9f493258e5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 95
content-type: text/html
date: Fri, 12 Aug 2022 02:26:06 GMT
last-modified: Thu, 11 Aug 2022 10:24:46 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 binnt-1.html Show response
bejamin.fr/ 86 B
338 B 272ms
67ms Document
text/html 2001:8d8:100f:f000::200
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://bejamin.fr/binnt-1.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::200 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 421fd172e69a589e205f7ff36d7a85c12ff6727a2dadf1638a0fdef334f33231

Request headers

Referer: https://pandithakash.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=3600
content-encoding: gzip
content-length: 103
content-type: text/html
date: Fri, 12 Aug 2022 02:26:08 GMT
etag: "56-5e5e98ef7139e-gzip"
expires: Fri, 12 Aug 2022 03:26:08 GMT
last-modified: Wed, 10 Aug 2022 21:16:12 GMT
server: Apache
vary: Accept-Encoding

GET
H2

200

Primary Request / Show response
crisstino.wonstasite.com/ykn/bkdd/
Redirect Chain

https://crisstino.wonstasite.com/ykn/bkdd
http://crisstino.wonstasite.com/ykn/bkdd/
https://crisstino.wonstasite.com/ykn/bkdd/

104 KB
16 KB

173ms
172ms

Document
text/html

34.76.112.83
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://crisstino.wonstasite.com/ykn/bkdd/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.76.112.83 Brussels, Belgium, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

83.112.76.34.bc.googleusercontent.com

Software

Resource Hash

87fcfb95bfcf47a61da49ce276d5af262baa99c00bcd37f3dee6dcc0a6703a21

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://bejamin.fr/binnt-1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 12 Aug 2022 02:26:09 GMT
strict-transport-security: max-age=15724800; includeSubDomains

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://crisstino.wonstasite.com/ykn/bkdd/
Non-Authoritative-Reason: HSTS

GET logo-safe-price-32.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET sp-settings-close.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET img-positive.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET img-negative.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET logo-safeprice-48.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET search-icon.svg
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET search-offers.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET search-coupons.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET no-offers.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET shield.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET arrow-rate.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET arrow-feedback.png
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET rate-check-gif.gif
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/icons/ 0
0

GET
H2 200 dkb-global.css
crisstino.wonstasite.com/ykn/bkdd/ 235 KB
38 KB 40ms
40ms Stylesheet
text/css 34.76.112.83
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://crisstino.wonstasite.com/ykn/bkdd/dkb-global.css

Requested by

Host: crisstino.wonstasite.com
URL: https://crisstino.wonstasite.com/ykn/bkdd/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.76.112.83 Brussels, Belgium, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

83.112.76.34.bc.googleusercontent.com

Software

Resource Hash

db6eb1b520d71a9abc8ea2e8fd5f4bc76ea3bcfcff7d8344ce6ccd2b2b7a6cf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://crisstino.wonstasite.com/ykn/bkdd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 02:26:09 GMT
content-encoding: br
last-modified: Wed, 10 Aug 2022 21:13:55 GMT
etag: W/"62f41f93-3acec"
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/css
cache-control: max-age=31536000
expires: Sat, 12 Aug 2023 02:26:09 GMT

GET
H2 200 dkb_responsive.min.css
crisstino.wonstasite.com/ykn/bkdd/ 620 KB
94 KB 67ms
67ms Stylesheet
text/css 34.76.112.83
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://crisstino.wonstasite.com/ykn/bkdd/dkb_responsive.min.css

Requested by

Host: crisstino.wonstasite.com
URL: https://crisstino.wonstasite.com/ykn/bkdd/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.76.112.83 Brussels, Belgium, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

83.112.76.34.bc.googleusercontent.com

Software

Resource Hash

38af949586d620cd21ff714742fb9eca95bcd2d70a22a3c1d9b35b75820020c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://crisstino.wonstasite.com/ykn/bkdd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 02:26:09 GMT
content-encoding: br
last-modified: Wed, 10 Aug 2022 21:13:55 GMT
etag: W/"62f41f93-9b1fb"
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/css
cache-control: max-age=31536000
expires: Sat, 12 Aug 2023 02:26:09 GMT

GET
H2 404 product-global.js
crisstino.wonstasite.com/wro/ 0
0 109ms
107ms Script
text/html 34.76.112.83
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://crisstino.wonstasite.com/wro/product-global.js?etag=4f2b2ef163d6e22c70deb82be72dcaaceeaf8642

Requested by

Host: crisstino.wonstasite.com
URL: https://crisstino.wonstasite.com/ykn/bkdd/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.76.112.83 Brussels, Belgium, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

83.112.76.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://crisstino.wonstasite.com/ykn/bkdd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 02:26:09 GMT
content-encoding: br
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/html

GET
H2 404 dkb-global.js
crisstino.wonstasite.com/wro/ 0
0 109ms
107ms Script
text/html 34.76.112.83
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://crisstino.wonstasite.com/wro/dkb-global.js?etag=35836b1d387fc003241a7b0e9255fe3a4f56344e

Requested by

Host: crisstino.wonstasite.com
URL: https://crisstino.wonstasite.com/ykn/bkdd/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.76.112.83 Brussels, Belgium, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

83.112.76.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://crisstino.wonstasite.com/ykn/bkdd/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 02:26:09 GMT
content-encoding: br
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/html

GET fonts.css
mbckjcfnjmoiinpgddefodcighgikkgn/common/ui/fonts/ 0
0