beipass.at
Open in
urlscan Pro
2a02:180:ffff:3::551f:b99d
Malicious Activity!
Public Scan
Effective URL: https://beipass.at/de/
Submission: On May 07 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 29th 2024. Valid for: 3 months.
This is the only time beipass.at was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a00:1450:400... 2a00:1450:4001:827::2001 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a02:180:ffff... 2a02:180:ffff:3::551f:b99d | 35366 (ISPPRO-AS...) (ISPPRO-AS ISPPRO-AS covers the networks of ISPpro) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 142.250.185.196 142.250.185.196 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a02:ec80:300... 2a02:ec80:300:ed1a::2:b | 14907 (WIKIMEDIA) (WIKIMEDIA) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::2003 | 15169 (GOOGLE) (GOOGLE) | |
10 | 6 |
ASN15169 (GOOGLE, US)
edff2d2fe4564ff98ef22cdba7034d04.page.link |
ASN35366 (ISPPRO-AS ISPPRO-AS covers the networks of ISPpro, DE)
beipass.at |
ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f4.1e100.net
www.google.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
855 B |
3 |
beipass.at
beipass.at |
4 KB |
1 |
gstatic.com
www.gstatic.com |
203 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 776 |
31 KB |
1 |
wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 3017 |
116 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3044 |
25 KB |
1 |
page.link
1 redirects
edff2d2fe4564ff98ef22cdba7034d04.page.link |
1 KB |
10 | 7 |
Domain | Requested by | |
---|---|---|
3 | www.google.com |
beipass.at
www.gstatic.com |
3 | beipass.at |
code.jquery.com
|
1 | www.gstatic.com |
www.google.com
|
1 | code.jquery.com |
beipass.at
|
1 | upload.wikimedia.org |
beipass.at
|
1 | stackpath.bootstrapcdn.com |
beipass.at
|
1 | edff2d2fe4564ff98ef22cdba7034d04.page.link | 1 redirects |
10 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
beipass.at R3 |
2024-03-29 - 2024-06-27 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2023-10-18 - 2024-10-16 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://beipass.at/de/
Frame ID: 0CB2479ADAE7BDFF3D0699D539FAF793
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdB6MspAAAAAAkoC2M2fJ3Gyfy21tl3p_LzsWUm&co=aHR0cHM6Ly9iZWlwYXNzLmF0OjQ0Mw..&hl=de&v=V6_85qpc2Xf2sbe3xTnRte7m&size=normal&cb=fvtccghzdxvo
Frame ID: 42DA2B47B183BDF2C3A13AE525A31C16
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=de&v=V6_85qpc2Xf2sbe3xTnRte7m&k=6LdB6MspAAAAAAkoC2M2fJ3Gyfy21tl3p_LzsWUm
Frame ID: 5983DABF1F017FC88B7D18C0B6F54767
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
SicherheitsüberprüfungPage URL History Show full URLs
-
https://edff2d2fe4564ff98ef22cdba7034d04.page.link/tobR
HTTP 302
https://beipass.at/de/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- <div[^>]+class="g-recaptcha"
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://edff2d2fe4564ff98ef22cdba7034d04.page.link/tobR
HTTP 302
https://beipass.at/de/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
beipass.at/de/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ |
1 KB 855 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2560px-ING-DiBa-Logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/1/14/ING-DiBa-Logo.svg/ |
115 KB 116 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.4.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
visitors.php
beipass.at/de/ |
40 B 234 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/ |
509 KB 203 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame 42DA |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 5983 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
beipass.at/ |
209 B 379 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 function| validateCaptcha function| $ function| jQuery object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_2033980 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
beipass.at
code.jquery.com
edff2d2fe4564ff98ef22cdba7034d04.page.link
stackpath.bootstrapcdn.com
upload.wikimedia.org
www.google.com
www.gstatic.com
104.18.10.207
142.250.185.196
2a00:1450:4001:81d::2003
2a00:1450:4001:827::2001
2a02:180:ffff:3::551f:b99d
2a02:ec80:300:ed1a::2:b
2a04:4e42::649
2beca36f607e1086c8af41558fab33305d717b25f21948963d81c5498159320b
352a6d9b12a5ae3949d370ff42a338ba8bb6ff455d9ba995b1755fb7b99e8824
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
9a4b05db21d259ccf3aa01d45ac924e9c041569b0642875cb2adb6142b378a57
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a7c0623837530c9110fc5b3a69a99b673f3ae7095b22502989476dac730f2051
b4a87969c4cc52d70e75db24b6bda485dbb1beef9ab5c4074e4020176ea1713b
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642