vfbmoschendorf.eu
Open in
urlscan Pro
2a02:180:ffff:3::551f:b99d
Malicious Activity!
Public Scan
Submission: On March 06 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 23rd 2024. Valid for: 3 months.
This is the only time vfbmoschendorf.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a02:180:ffff... 2a02:180:ffff:3::551f:b99d | 35366 (ISPPRO-AS...) (ISPPRO-AS ISPPRO-AS covers the networks of ISPpro) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2607:f8b0:400... 2607:f8b0:4006:823::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2620:0:861:ed... 2620:0:861:ed1a::2:b | 14907 (WIKIMEDIA) (WIKIMEDIA) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
6 | 2607:f8b0:400... 2607:f8b0:4006:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:809::2003 | 15169 (GOOGLE) (GOOGLE) | |
17 | 8 |
ASN35366 (ISPPRO-AS ISPPRO-AS covers the networks of ISPpro, DE)
vfbmoschendorf.eu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
652 KB |
5 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
39 KB |
2 |
vfbmoschendorf.eu
vfbmoschendorf.eu |
4 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
31 KB |
1 |
wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 2808 |
116 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2945 |
25 KB |
17 | 6 |
Domain | Requested by | |
---|---|---|
6 | www.gstatic.com |
www.google.com
www.gstatic.com |
5 | www.google.com |
vfbmoschendorf.eu
www.gstatic.com www.google.com |
2 | vfbmoschendorf.eu |
code.jquery.com
|
1 | fonts.gstatic.com |
www.google.com
|
1 | code.jquery.com |
vfbmoschendorf.eu
|
1 | upload.wikimedia.org |
vfbmoschendorf.eu
|
1 | stackpath.bootstrapcdn.com |
vfbmoschendorf.eu
|
17 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
vfbmoschendorf.eu R3 |
2024-01-23 - 2024-04-22 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-01-28 - 2024-04-27 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
*.wikipedia.org R3 |
2024-02-18 - 2024-05-18 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://vfbmoschendorf.eu/dvd/de/
Frame ID: E178CA7841006A3E418D8FAD99975273
Requests: 7 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LedsYcpAAAAAOVMsfykmnXud1UnQuWnL7ddkv0m&co=aHR0cHM6Ly92ZmJtb3NjaGVuZG9yZi5ldTo0NDM.&hl=en&v=vj7hFxe2iNgbe-u95xTozOXW&size=normal&cb=vuqjeaoyyz7z
Frame ID: B9B7CE98CBD522A144B3EC9C31386F3B
Requests: 9 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=vj7hFxe2iNgbe-u95xTozOXW&k=6LedsYcpAAAAAOVMsfykmnXud1UnQuWnL7ddkv0m
Frame ID: FFB825273E5530C7C45AB15E75FB7EF8
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
SicherheitsüberprüfungDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- <div[^>]+class="g-recaptcha"
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
vfbmoschendorf.eu/dvd/de/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2560px-ING-DiBa-Logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/1/14/ING-DiBa-Logo.svg/ |
115 KB 116 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.4.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/ |
492 KB 196 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
visitors.php
vfbmoschendorf.eu/dvd/de/ |
40 B 234 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame B9B7 |
46 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/ Frame B9B7 |
55 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/ Frame B9B7 |
492 KB 195 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame B9B7 |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame B9B7 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame B9B7 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame B9B7 |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9WFGRKJPCYDnPNtkHsd9A4DmYMQ5DrBGEy3ZqrvSuE0.js
www.google.com/js/bg/ Frame B9B7 |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webworker.js
www.google.com/recaptcha/api2/ Frame B9B7 |
102 B 135 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame FFB8 |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/ Frame FFB8 |
55 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/ Frame FFB8 |
492 KB 195 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| validateCaptcha function| $ function| jQuery object| recaptcha object| closure_lm_56490 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.gstatic.com
stackpath.bootstrapcdn.com
upload.wikimedia.org
vfbmoschendorf.eu
www.google.com
www.gstatic.com
2606:4700::6812:bcf
2607:f8b0:4006:809::2003
2607:f8b0:4006:81c::2003
2607:f8b0:4006:823::2004
2620:0:861:ed1a::2:b
2a02:180:ffff:3::551f:b99d
2a04:4e42:200::649
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
2beca36f607e1086c8af41558fab33305d717b25f21948963d81c5498159320b
2c6a3425cec9ba0cbcfcf1dbba2120a72ac369674a6d02e06bd3b0c16efbdcf7
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
7079938c17b2d6f15214ff41c2bd42fcdc52826f5c7b754924d57a41b4c3f82f
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
793414a5c29820d33c9a6a7120fdbbf4fdbabaf3f3cc0176a53336cc5bb4da5c
8e5125c71dff54e83db900ff6d0bf3163e21e835bdd9d3ad01f4252a99c8e94b
9e83aa0d0a596233f74b6f08499440b83de39498207579687aec194b10fce49e
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a7c0623837530c9110fc5b3a69a99b673f3ae7095b22502989476dac730f2051
c8decb7c7d17d6353f74d740f2afba7886d2c53e0b3d10a44ae1ad7738316ff9
f5614644a24f0980e73cdb641ec77d0380e660c4390eb046132dd9aabbd2b84d