urlscan.io logo urlscan.io
SecurityTrails logo

sparkasse-directservice17.xyz Open in urlscan Pro
2606:4700:3035::6815:201e  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Submission: On March 08 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3035::6815:201e, located in United States and belongs to CLOUDFLARENET, US. The main domain is sparkasse-directservice17.xyz.
This is the only time sparkasse-directservice17.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
8 2606:4700:303... 13335 (CLOUDFLAR...)
8 1
Apex Domain
Subdomains		 Transfer
8 sparkasse-directservice17.xyz
sparkasse-directservice17.xyz
189 KB
8 1
Domain Requested by
8 sparkasse-directservice17.xyz sparkasse-directservice17.xyz
8 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Frame ID: AC6579A50633CF845D42D155C417FC0B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

8
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

189 kB
Transfer

400 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set anmeldung.php
sparkasse-directservice17.xyz/spk/ 		11 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
820e9c07a357413578465c3d240848b1574800f2addf6ee4161ecc11e2baddee

Request headers

Host
sparkasse-directservice17.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:17 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d165db30624aae89deec05b72337cce661615209437; expires=Wed, 07-Apr-21 13:17:17 GMT; path=/; domain=.sparkasse-directservice17.xyz; HttpOnly; SameSite=Lax PHPSESSID=nmgtottacv5ohc6sachm8t5ln5; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Vary
Accept-Encoding
CF-Cache-Status
DYNAMIC
cf-request-id
08b395323100004e558db5f000000001
Report-To
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=W0SY1ak7U1xGtFA6gy2n7l%2FkNTKBqzKgclZQI6xUvl%2Boakb9kTyGSGuGokBy%2BSQ%2BdyZ%2BBjsKC%2BICgJN8DV2l%2BaazJTF4Gwk2Ex5pBhtIsBgtVEd4NK%2Ftyzctj7EWrFcypBcQUdviiVfoig%3D%3D"}],"max_age":604800}
NEL
{"max_age":604800,"report_to":"cf-nel"}
Server
cloudflare
CF-RAY
62cc57c9ea474e55-FRA
Content-Encoding
gzip
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
sparkasse-directservice17.xyz/spk/src/css/ 		249 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8b51ca2d76d70709c6c9aa47b504dc4484cf89b508df064dc9c2b53d6ee75c4

Request headers

Referer
http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
NEL
{"max_age":604800,"report_to":"cf-nel"}
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
41937
cf-request-id
08b395331900004e556601d000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
"3e436-5b77954168a35-gzip"
Vary
Accept-Encoding
Report-To
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4Q%2FDIp7Rk320IbvoZcXFNsJYOd47py9pR5y4iJd2skwo9cIliAMHsv91SzXwfsLOt5U5X9nsuDVDDL1%2F71w3rT8Q5BkunuwAH4gdjXncA4BxBduJFX7Gr3kNtANVxDxH08MCYS2oa5fo4Q%3D%3D"}],"max_age":604800}
Content-Type
text/css
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
62cc57cb5ca94e55-FRA
ZR1pMwPB9Xsl53CW8qSL.png
sparkasse-directservice17.xyz/spk/src/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://sparkasse-directservice17.xyz/spk/src/img/ZR1pMwPB9Xsl53CW8qSL.png
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9e830e96a27b155e68fbf2bd76b10c2e9e054874c9c3c1e97bbaea573259894

Request headers

Referer
http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
CF-Cache-Status
MISS
NEL
{"max_age":604800,"report_to":"cf-nel"}
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
1902
cf-request-id
08b395331f00002bcea92f8000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
"76e-5b77954168e1d"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hqi3A1LXFBIMbuV1l%2BUtQCo8Bd5ybSYzguCh6bLl45dz9QzbYrA46uWr0ko6NkNSDjLFr2mqOmxgKQNwpVoJktjiEtQ9f4nFyP%2FCNQgshp3G02pNXn%2FNuxPz8FIsg8ZOkKgUZAQontW6cw%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
62cc57cb6d9c2bce-FRA
WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png
sparkasse-directservice17.xyz/spk/src/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://sparkasse-directservice17.xyz/spk/src/img/WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ef3568cb4cbc5b4a96dba63ccff15a441eac6d17c91fa963d2ac1b4534520d6

Request headers

Referer
http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
CF-Cache-Status
MISS
NEL
{"max_age":604800,"report_to":"cf-nel"}
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
2729
cf-request-id
08b395331f00004d8a6697e000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
"aa9-5b77954168e1d"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aVD5NsFLueBGMNNWTxQEhw56uKqFHBHrYnM9nqkxDDjkS5L5jN3PPRrL5zt50OdV7fgAE%2Bc%2FserOEGYwgwCQ%2BXFHSKcMmriJdenw4a4yHbch8TRm1fzkYjR4d6ptObr6CbjdCe07k4ODvg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
62cc57cb69d94d8a-FRA
spk-logo-druck.png
sparkasse-directservice17.xyz/spk/src/img/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://sparkasse-directservice17.xyz/spk/src/img/spk-logo-druck.png
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d16cd665d719c20820702b390ce43791ec4ae374d5233251b04d578264808684

Request headers

Referer
http://sparkasse-directservice17.xyz/spk/anmeldung.php?starten=euFYk26WX1pC7lJ9ZGfIyDxnVObN54&shufflUri?=GAumTxjofVkCF7NIE4O6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
CF-Cache-Status
MISS
NEL
{"report_to":"cf-nel","max_age":604800}
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
10048
cf-request-id
08b395331f00002b95fc249000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
"2740-5b77954168e1d"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=odNxEH0Gr6FMBLCMsAGGVK2N4ohjFExPVcbZCMrBWaPJjPT7RqFq%2BkmJEOaNMht3SwFRKv7Eu0j3%2Bx0f8EoRLYZ0pSYRPUMQAdfCOdOIX6ItRaKCuAbWXmGsmwXSV2zSSExpWlHrbwqXDg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
62cc57cb684f2b95-FRA
GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff
sparkasse-directservice17.xyz/spk/src/fonts/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://sparkasse-directservice17.xyz/spk/src/fonts/GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2

Request headers

Origin
http://sparkasse-directservice17.xyz
Referer
http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
NEL
{"max_age":604800,"report_to":"cf-nel"}
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08b395347400004e5558ab0000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
W/"9a44-5b77954168a35"
Vary
Accept-Encoding
Report-To
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0ms82gP%2BTk9DYt5Sj44tcKw%2BX1yAaC8vAc3PkZrnnYVHKR0jqVtP4d6Pd0DiPUXhZ%2F4U84UgD9MYPQ2FauSlWlspDoTYYG6fLYZ%2BOs5KpxEhqlcNVS%2FtBXjSKt%2BQoKTrfkXNcMEUL0TQ9w%3D%3D"}],"max_age":604800}
Content-Type
application/font-woff
Cache-Control
max-age=14400
CF-RAY
62cc57cd889d4e55-FRA
AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff
sparkasse-directservice17.xyz/spk/src/fonts/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://sparkasse-directservice17.xyz/spk/src/fonts/AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

Request headers

Origin
http://sparkasse-directservice17.xyz
Referer
http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
NEL
{"max_age":604800,"report_to":"cf-nel"}
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08b395347400004d8a1c919000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
W/"9b38-5b77954168a35"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1sh80k%2BQdj9plCBMM6hv5AEK2qbLJhfzDDw2LDYjBeosvLD0r%2B2R0AI5r9fgWJHgjjuQeG7IMY2otVY%2B3E3FfXw3lEwpoM%2BuwBw8B5Lc8zStWW4gD1Og0t7IRI4%2FI%2BQQGZh1HF8zzQFAWA%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/font-woff
Cache-Control
max-age=14400
CF-RAY
62cc57cd8cd94d8a-FRA
pictos-if.woff
sparkasse-directservice17.xyz/spk/src/fonts/ 		48 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://sparkasse-directservice17.xyz/spk/src/fonts/pictos-if.woff
Requested by
Host: sparkasse-directservice17.xyz
URL: http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Protocol
HTTP/1.1
Server
2606:4700:3035::6815:201e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03

Request headers

Origin
http://sparkasse-directservice17.xyz
Referer
http://sparkasse-directservice17.xyz/spk/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Mar 2021 13:17:18 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
NEL
{"max_age":604800,"report_to":"cf-nel"}
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08b395347a00002bcea1abf000000001
Last-Modified
Sun, 27 Dec 2020 22:03:33 GMT
Server
cloudflare
ETag
W/"be24-5b77954168a35"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jJc0xDuC6eZpXCTMvZVewTCosg2aqEbpYAESbSZ5KGw1pBZRii4N%2By4hHQNtUZ6Tu0s4t%2BiuizimgQ7t557RSdQCn8IYuiHerBoSWOFkDjhA4faisOmprWG06Cs61HrZuR7SENmJG2P2WQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/font-woff
Cache-Control
max-age=14400
CF-RAY
62cc57cd896b2bce-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

2 Cookies

Domain/Path Name / Value
sparkasse-directservice17.xyz/ Name: PHPSESSID
Value: nmgtottacv5ohc6sachm8t5ln5
.sparkasse-directservice17.xyz/ Name: __cfduid
Value: d165db30624aae89deec05b72337cce661615209437