dalamp.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 2606:4700:30::681b:86d2, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is dalamp.com.

This is the only time dalamp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: N26 (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:30:... 2606:4700:30::681b:86d2	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2606:4700:30:... 2606:4700:30::681b:87d2	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
6	2

4 2606:4700:30::681b:86d2 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

dalamp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:30::681b:87d2 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

dalamp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	dalamp.com dalamp.com	333 KB
6	1

	Domain	Requested by
6	dalamp.com	dalamp.com
6	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://dalamp.com/N26-Login-BACKSTAGE/app-de/
Frame ID: 8F63AF3B46A958C05BFA612A3E957398
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

6
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

333 kB
Transfer

349 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response dalamp.com/N26-Login-BACKSTAGE/app-de/	24 KB 6 KB	59ms 18ms	Document text/html	2606:4700:30::681b:86d2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Protocol HTTP/1.1 Server 2606:4700:30::681b:86d2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PHP/5.5.9-1ubuntu4.27 PleskLin Resource Hash `79b046bd31e6192273652bf68c76e0acaf14aff3cabf71fff0cc2184c0672bf6` Request headers Host dalamp.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 16 Apr 2019 09:51:52 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=dda9ee00d7887a411f5d7b7f5ba1984481555408312; expires=Wed, 15-Apr-20 09:51:52 GMT; path=/; domain=.dalamp.com; HttpOnly X-Powered-By PHP/5.5.9-1ubuntu4.27 PleskLin Vary Accept-Encoding Server cloudflare CF-RAY 4c854360ae0bbf0c-FRA Content-Encoding gzip
GET H/1.1	200 OK	Calibre-Regular.latin.woff2 dalamp.com/N26-Login-BACKSTAGE/app-de/styles/	11 KB 11 KB	14ms 13ms	Font application/octet-stream	2606:4700:30::681b:86d2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://dalamp.com/N26-Login-BACKSTAGE/app-de/styles/Calibre-Regular.latin.woff2 Requested by Host: dalamp.com URL: http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Protocol HTTP/1.1 Server 2606:4700:30::681b:86d2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `fea31ba377c83c59ea86525770f65bfb1a59b7294512f43772a310a2b10ca4a6` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host dalamp.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Cookie __cfduid=dda9ee00d7887a411f5d7b7f5ba1984481555408312 Connection keep-alive Cache-Control no-cache Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 16 Apr 2019 09:51:52 GMT CF-Cache-Status REVALIDATED Last-Modified Tue, 19 Mar 2019 15:38:36 GMT Server cloudflare X-Powered-By PleskLin ETag "5c910cfc-2b9c" Vary Accept-Encoding Content-Type application/octet-stream Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 4c854360ce24bf0c-FRA Content-Length 11164 Expires Tue, 16 Apr 2019 13:51:52 GMT
GET H/1.1	200 OK	Calibre-Medium.latin.woff2 dalamp.com/N26-Login-BACKSTAGE/app-de/styles/	10 KB 11 KB	26ms 16ms	Font application/octet-stream	2606:4700:30::681b:87d2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://dalamp.com/N26-Login-BACKSTAGE/app-de/styles/Calibre-Medium.latin.woff2 Requested by Host: dalamp.com URL: http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Protocol HTTP/1.1 Server 2606:4700:30::681b:87d2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `14ed3c215977794f142b9cbdd48d102f57f5fec344d630a4d863543758b79244` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host dalamp.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Cookie __cfduid=dda9ee00d7887a411f5d7b7f5ba1984481555408312 Connection keep-alive Cache-Control no-cache Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 16 Apr 2019 09:51:52 GMT CF-Cache-Status REVALIDATED Last-Modified Tue, 19 Mar 2019 15:38:36 GMT Server cloudflare X-Powered-By PleskLin ETag "5c910cfc-2854" Vary Accept-Encoding Content-Type application/octet-stream Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 4c854360df5897b6-FRA Content-Length 10324 Expires Tue, 16 Apr 2019 13:51:52 GMT
GET H/1.1	200 OK	background-login.6cc8fa2b.jpg dalamp.com/N26-Login-BACKSTAGE/app-de/styles/	283 KB 283 KB	25ms 18ms	Image image/jpeg	2606:4700:30::681b:86d2 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://dalamp.com/N26-Login-BACKSTAGE/app-de/styles/background-login.6cc8fa2b.jpg Requested by Host: dalamp.com URL: http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Protocol HTTP/1.1 Server 2606:4700:30::681b:86d2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `26b0ee7dfc6d7bb5affe9b970c2fa909f60fb018d2022bfd1b932daf9ccdd2f2` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host dalamp.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Cookie __cfduid=dda9ee00d7887a411f5d7b7f5ba1984481555408312 Connection keep-alive Cache-Control no-cache Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 16 Apr 2019 09:51:52 GMT CF-Cache-Status REVALIDATED Last-Modified Tue, 19 Mar 2019 15:38:36 GMT Server cloudflare X-Powered-By PleskLin ETag "5c910cfc-46b3a" Vary Accept-Encoding Content-Type image/jpeg Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 4c854360d9d0bebc-FRA Content-Length 289594 Expires Tue, 16 Apr 2019 13:51:52 GMT
GET H/1.1	200 OK	Calibre-Medium.latin.woff2 dalamp.com/N26-Login-BACKSTAGE/app-de/styles/	10 KB 11 KB	23ms 21ms	Font application/octet-stream	2606:4700:30::681b:87d2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://dalamp.com/N26-Login-BACKSTAGE/app-de/styles/Calibre-Medium.latin.woff2 Requested by Host: dalamp.com URL: http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Protocol HTTP/1.1 Server 2606:4700:30::681b:87d2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `14ed3c215977794f142b9cbdd48d102f57f5fec344d630a4d863543758b79244` Request headers Pragma no-cache Origin http://dalamp.com Accept-Encoding gzip, deflate Host dalamp.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Cookie __cfduid=dda9ee00d7887a411f5d7b7f5ba1984481555408312 Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Origin http://dalamp.com Response headers Date Tue, 16 Apr 2019 09:51:52 GMT CF-Cache-Status MISS Last-Modified Tue, 19 Mar 2019 15:38:36 GMT Server cloudflare X-Powered-By PleskLin ETag "5c910cfc-2854" Vary Accept-Encoding Content-Type application/octet-stream Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 4c854360cf4d97b6-FRA Content-Length 10324 Expires Tue, 16 Apr 2019 13:51:52 GMT
GET H/1.1	200 OK	Calibre-Regular.latin.woff2 dalamp.com/N26-Login-BACKSTAGE/app-de/styles/	11 KB 11 KB	20ms 16ms	Font application/octet-stream	2606:4700:30::681b:86d2 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://dalamp.com/N26-Login-BACKSTAGE/app-de/styles/Calibre-Regular.latin.woff2 Requested by Host: dalamp.com URL: http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Protocol HTTP/1.1 Server 2606:4700:30::681b:86d2 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PleskLin Resource Hash `fea31ba377c83c59ea86525770f65bfb1a59b7294512f43772a310a2b10ca4a6` Request headers Pragma no-cache Origin http://dalamp.com Accept-Encoding gzip, deflate Host dalamp.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Cookie __cfduid=dda9ee00d7887a411f5d7b7f5ba1984481555408312 Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://dalamp.com/N26-Login-BACKSTAGE/app-de/ Origin http://dalamp.com Response headers Date Tue, 16 Apr 2019 09:51:52 GMT CF-Cache-Status MISS Last-Modified Tue, 19 Mar 2019 15:38:36 GMT Server cloudflare X-Powered-By PleskLin ETag "5c910cfc-2b9c" Vary Accept-Encoding Content-Type application/octet-stream Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 4c854360d9c5bea8-FRA Content-Length 11164 Expires Tue, 16 Apr 2019 13:51:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: N26 (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dalamp.com/	1970-01-19 08:49:04	Name: __cfduid Value: dda9ee00d7887a411f5d7b7f5ba1984481555408312

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dalamp.com
2606:4700:30::681b:86d2
2606:4700:30::681b:87d2
14ed3c215977794f142b9cbdd48d102f57f5fec344d630a4d863543758b79244
26b0ee7dfc6d7bb5affe9b970c2fa909f60fb018d2022bfd1b932daf9ccdd2f2
79b046bd31e6192273652bf68c76e0acaf14aff3cabf71fff0cc2184c0672bf6
fea31ba377c83c59ea86525770f65bfb1a59b7294512f43772a310a2b10ca4a6

dalamp.com Open in urlscan Pro 2606:4700:30::681b:86d2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

6 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

333 kBTransfer

349 kBSize

1 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

dalamp.com Open in urlscan Pro
2606:4700:30::681b:86d2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

333 kB
Transfer

349 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!