bwiagpsk.com Open in urlscan Pro
159.65.12.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bwiagpsk.com/InternetBanking7835?1897424662
Submission: On July 04 via automatic, source phishtank (July 4th 2019, 5:05:00 am UTC)

Summary HTTP 1 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 159.65.12.227, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is bwiagpsk.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 2nd 2019. Valid for: 3 months.

This is the only time bwiagpsk.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BAWAG P.S.K. (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1	159.65.12.227 159.65.12.227		14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1	2

1 159.65.12.227 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: web.de

bwiagpsk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	bwiagpsk.com bwiagpsk.com	214 KB
1	1

	Domain	Requested by
1	bwiagpsk.com
1	1

This site contains links to these domains. Also see Links.

Domain
www.bawagpsk.com
ebanking.bawagpsk.com
demo-ebanking.bawagpsk.com

Subject Issuer	Validity	Valid
bwiagpsk.com Let's Encrypt Authority X3	`2019-07-02` - `2019-09-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bwiagpsk.com/InternetBanking7835?1897424662
Frame ID: 1A806EE0808E1235DF3C0748D723D983
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

214 kB
Transfer

592 kB
Size

1
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: http://www.bawagpsk.com/

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/BAWAGPSK/PK/ebanking/faq#Verfueger
Title: Verfüger gesperrt

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/BAWAGPSK/PK/ebanking/faq#PIN
Title: Pin vergessen

Search URL Search Domain Scan URL

URL: https://ebanking.bawagpsk.com/InternetBanking/InternetBanking/
Title: Login mit Signaturkarte

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/BAWAGPSK/Sicherheit/467080/20190524.html
Title: Aktuelle Warnungen Mai 2019Vielzahl an Phishing Mails im Umlauf

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/BAWAGPSK/Sicherheit/403380/regel.html
Title: Sicherheitsregeln

Search URL Search Domain Scan URL

URL: http://demo-ebanking.bawagpsk.com/
Title: eBanking Demo

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/linkableblob/BAWAGPSK/197332/70c32222f7ad2f2c14847317c25c7d25/ebanking-erste-schritte-data.pdf
Title: Anmeldung / Erste Schritte

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/BAWAGPSK/PK/ebanking/tanverfahren/317106/digitale-signatur.html
Title: Erstanmeldung der Signaturkarte

Search URL Search Domain Scan URL

URL: http://www.bawagpsk.com/BAWAG/PK/SK/RE/384/Impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: http://www.bawagpsk.com/BAWAG/PK/SK/RE/382/AGB.html
Title: AGB

Search URL Search Domain Scan URL

URL: http://www.bawagpsk.com/BAWAG/PK/SK/RE/380/Datenschutz.html
Title: Datenschutz

Search URL Search Domain Scan URL

URL: http://www.bawagpsk.com/BAWAG/PK/SK/RE/376/Nutzungsbedingungen.html
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://www.bawagpsk.com/BAWAGPSK/PK/277026/barrierefreiheit.html
Title: Barrierefrei

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
12 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set InternetBanking7835 Show response bwiagpsk.com/	348 KB 214 KB	350ms 349ms	Document text/html	159.65.12.227 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://bwiagpsk.com/InternetBanking7835?1897424662 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 159.65.12.227 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS web.de Software nginx / Resource Hash `a088a700d52956100a29b3ea1d031f5507738b6526cd8c9122765ae48f765484` Request headers Host bwiagpsk.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx Date Thu, 04 Jul 2019 05:04:43 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Set-Cookie PHPSESSID=99tatauous41vprsg7v7jpe0d0; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding Content-Encoding gzip
GET DATA	200 OK	truncated /	2 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1ff7504c16daf2d34a784b611556b922f7adcc5f5eae1b58c41d81c827742b5c` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	1 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f4d8e679d4b360282d5b9c0e578e2f30fd6939df399bfc0d1c80504e1b67b2be` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cf61215ca4a5c69c1225fc2e5e70ab84a498a4c6ba3c7b48c3a16a6f5f34f650` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f4deb3dd818172554ec3a7f0d4883dbe5b0d21cd33982c33c7ae1483b49d7982` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2154cb7ff608980de400c7c4101f315c4b02066ff61efe86810f769bc235e867` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	214 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `03ef20287cdd93208b33b70a7ec135d04e89340cb741dd337364512269f097b9` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dd0a334ed68480714349b7b248abae9311919b27291fcd7589d8c754cf572bb7` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	15 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e011026f31943494769a0c29bcc2482ef11ffaaf34029da3bf1ebec9427aa767` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `23293f3c3e0c25475403d731ab9764c240256c6956c26adcb5a7995221c4a082` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `acbfecd34d006963ec250ff9af21cdc4f939af72785b2481c5cd07ab64d0277e` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4552da35c2b04619df857822c5249854e21211984aecd0c443b810b5d93028f8` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `07d4a6c87dea5b48ca1dc0c6d35cb99674f088884b53954f7310d85cf26c1963` Request headers Referer https://bwiagpsk.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BAWAG P.S.K. (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bwiagpsk.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 99tatauous41vprsg7v7jpe0d0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bwiagpsk.com
159.65.12.227
03ef20287cdd93208b33b70a7ec135d04e89340cb741dd337364512269f097b9
07d4a6c87dea5b48ca1dc0c6d35cb99674f088884b53954f7310d85cf26c1963
1ff7504c16daf2d34a784b611556b922f7adcc5f5eae1b58c41d81c827742b5c
2154cb7ff608980de400c7c4101f315c4b02066ff61efe86810f769bc235e867
23293f3c3e0c25475403d731ab9764c240256c6956c26adcb5a7995221c4a082
4552da35c2b04619df857822c5249854e21211984aecd0c443b810b5d93028f8
a088a700d52956100a29b3ea1d031f5507738b6526cd8c9122765ae48f765484
acbfecd34d006963ec250ff9af21cdc4f939af72785b2481c5cd07ab64d0277e
cf61215ca4a5c69c1225fc2e5e70ab84a498a4c6ba3c7b48c3a16a6f5f34f650
dd0a334ed68480714349b7b248abae9311919b27291fcd7589d8c754cf572bb7
e011026f31943494769a0c29bcc2482ef11ffaaf34029da3bf1ebec9427aa767
f4d8e679d4b360282d5b9c0e578e2f30fd6939df399bfc0d1c80504e1b67b2be
f4deb3dd818172554ec3a7f0d4883dbe5b0d21cd33982c33c7ae1483b49d7982

bwiagpsk.com Open in urlscan Pro 159.65.12.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

214 kBTransfer

592 kBSize

1 Cookies

14 Outgoing links

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

bwiagpsk.com Open in urlscan Pro
159.65.12.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

214 kB
Transfer

592 kB
Size

1
Cookies

1 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!