dempassportboys.com
Open in
urlscan Pro
192.254.185.18
Malicious Activity!
Public Scan
Effective URL: https://dempassportboys.com/well/dkb.de/banking/de/
Submission: On June 27 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 6th 2023. Valid for: 3 months.
This is the only time dempassportboys.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DKB (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.254.224.19 192.254.224.19 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 7 | 192.254.185.18 192.254.185.18 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
5 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-254-224-19.unifiedlayer.com
myhome-ks.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-254-185-18.unifiedlayer.com
dempassportboys.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
dempassportboys.com
2 redirects
dempassportboys.com |
167 KB |
1 |
myhome-ks.com
1 redirects
myhome-ks.com |
185 B |
5 | 2 |
Domain | Requested by | |
---|---|---|
7 | dempassportboys.com |
2 redirects
dempassportboys.com
|
1 | myhome-ks.com | 1 redirects |
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.dempassportboys.com R3 |
2023-06-06 - 2023-09-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dempassportboys.com/well/dkb.de/banking/de/
Frame ID: D51C1346399AC5A129AD7C342A683448
Requests: 5 HTTP requests in this frame
Screenshot
Page Title
DKB - Deutsche Kreditbank AGPage URL History Show full URLs
-
https://myhome-ks.com/kaab/dk11/successme.php
HTTP 302
https://dempassportboys.com/well/dkb.de/banking HTTP 301
https://dempassportboys.com/well/dkb.de/banking/ Page URL
-
https://dempassportboys.com/well/dkb.de/banking/de
HTTP 301
https://dempassportboys.com/well/dkb.de/banking/de/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://myhome-ks.com/kaab/dk11/successme.php
HTTP 302
https://dempassportboys.com/well/dkb.de/banking HTTP 301
https://dempassportboys.com/well/dkb.de/banking/ Page URL
-
https://dempassportboys.com/well/dkb.de/banking/de
HTTP 301
https://dempassportboys.com/well/dkb.de/banking/de/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://myhome-ks.com/kaab/dk11/successme.php HTTP 302
- https://dempassportboys.com/well/dkb.de/banking HTTP 301
- https://dempassportboys.com/well/dkb.de/banking/
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
dempassportboys.com/well/dkb.de/banking/ Redirect Chain
|
244 B 264 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
dempassportboys.com/well/dkb.de/banking/de/ Redirect Chain
|
1 KB 626 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
dempassportboys.com/well/dkb.de/banking/de/ |
1 KB 512 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Calque0.png
dempassportboys.com/well/dkb.de/banking/de/images/ |
165 KB 165 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_Button1_bkgrnd.png
dempassportboys.com/well/dkb.de/banking/de/images/ |
1 B 74 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DKB (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dempassportboys.com
myhome-ks.com
192.254.185.18
192.254.224.19
49f6245bc241ea56b523a24abaa9c031f54880105e09a6eb9aa4ae03fae425b9
6a43edc7adc97f18050526ce962b0e00a9700157e33aebf709be01db007902a2
9b947115ef2a807f3981e9035613650054a41d342676ba866871cad273557d74
cd6ec7c3a2d08a5b7ce38cc52514caeb25e86c166ab1bd80d50d41b12571146d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855