dkb.de-banking-id48afjf7812nafzhharri.xyz
Open in
urlscan Pro
31.13.195.137
Malicious Activity!
Public Scan
Submitted URL: https://tinyurl.com/y7hnkdtp
Effective URL: http://dkb.de-banking-id48afjf7812nafzhharri.xyz/
Submission: On January 24 via manual from DE — Scanned from DE
Effective URL: http://dkb.de-banking-id48afjf7812nafzhharri.xyz/
Submission: On January 24 via manual from DE — Scanned from DE
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 11 HTTP transactions.
The main IP is 31.13.195.137, located in
Bulgaria and
belongs to NETERRA-AS, BG.
The main domain is dkb.de-banking-id48afjf7812nafzhharri.xyz.
This is the only time dkb.de-banking-id48afjf7812nafzhharri.xyz was scanned on urlscan.io!
This is the only time dkb.de-banking-id48afjf7812nafzhharri.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DKB (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 2606:4700:10:... 2606:4700:10::ac43:1e1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 2 | 85.13.128.110 85.13.128.110 | 34788 (NMM-AS D) (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68) | |
| 9 | 31.13.195.137 31.13.195.137 | 34224 (NETERRA-AS) (NETERRA-AS) | |
| 11 | 3 |
2
85.13.128.110
(Neusalza-Spremberg, Germany)
ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd45534.kasserver.com
ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd45534.kasserver.com
| template.leonschmid-design.de |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
de-banking-id48afjf7812nafzhharri.xyz
dkb.de-banking-id48afjf7812nafzhharri.xyz |
275 KB |
| 2 |
leonschmid-design.de
template.leonschmid-design.de |
935 B |
| 1 |
tinyurl.com
1 redirects
tinyurl.com — Cisco Umbrella Rank: 17392 |
433 B |
| 11 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | dkb.de-banking-id48afjf7812nafzhharri.xyz |
dkb.de-banking-id48afjf7812nafzhharri.xyz
|
| 2 | template.leonschmid-design.de |
template.leonschmid-design.de
|
| 1 | tinyurl.com | 1 redirects |
| 11 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.dkb.de |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| template.leonschmid-design.de R3 |
2021-11-30 - 2022-02-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://dkb.de-banking-id48afjf7812nafzhharri.xyz/
Frame ID: D2F883BE4785F44BCEB2E5577D1C3F96
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
DKB - Deutsche Kreditbank AGPage URL History Show full URLs
-
https://tinyurl.com/y7hnkdtp
HTTP 301
https://template.leonschmid-design.de/appreciate.php Page URL
- https://template.leonschmid-design.de/appreciate.php Page URL
- http://dkb.de-banking-id48afjf7812nafzhharri.xyz/ Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.dkb.de/Welcome/content/RequestPin.xhtml
Title: Passwort vergessen
Title: Passwort vergessen
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://tinyurl.com/y7hnkdtp
HTTP 301
https://template.leonschmid-design.de/appreciate.php Page URL
- https://template.leonschmid-design.de/appreciate.php Page URL
- http://dkb.de-banking-id48afjf7812nafzhharri.xyz/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://tinyurl.com/y7hnkdtp HTTP 301
- https://template.leonschmid-design.de/appreciate.php
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
appreciate.php
template.leonschmid-design.de/ Redirect Chain
|
937 B 473 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
appreciate.php
template.leonschmid-design.de/ |
982 B 462 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
dkb.de-banking-id48afjf7812nafzhharri.xyz/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style1.css
dkb.de-banking-id48afjf7812nafzhharri.xyz/css/ |
238 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style2.css
dkb.de-banking-id48afjf7812nafzhharri.xyz/css/ |
595 KB 115 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.620d46e3.chunk.css
dkb.de-banking-id48afjf7812nafzhharri.xyz/static/css/ |
1 KB 741 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2.958c0717.chunk.js
dkb.de-banking-id48afjf7812nafzhharri.xyz/static/js/ |
191 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.26da57f2.chunk.js
dkb.de-banking-id48afjf7812nafzhharri.xyz/static/js/ |
41 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
login
dkb.de-banking-id48afjf7812nafzhharri.xyz/backend-dev/phishing-api/ |
180 B 807 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
man-with-thing.aab12826.jpg
dkb.de-banking-id48afjf7812nafzhharri.xyz/static/media/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
woman_in_car.a2190261.jpg
dkb.de-banking-id48afjf7812nafzhharri.xyz/static/media/ |
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
475 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
948 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
208 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
846 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
686 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
944 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
856 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
669 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
864 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
871 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DKB (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| webpackJsonppostbank-phishing-script2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| template.leonschmid-design.de/ | Name: d Value: 0 |
|
| template.leonschmid-design.de/ | Name: n Value: Etc/Unknown |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dkb.de-banking-id48afjf7812nafzhharri.xyz
template.leonschmid-design.de
tinyurl.com
2606:4700:10::ac43:1e1
31.13.195.137
85.13.128.110
0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9
0ee43dc1194499de50310632f979d38719f594721a07f22133616016e0b9997e
0fe9650923b3c4d5d1b829c47a2a4eb9b6931a06132036a02c570e355f53ec87
1c9524bad0ee009f3f9e6af79cf3363acbcd6a4f03eec2ca8c16ff794358d81d
24483b4771b2128af4110c159a9dcb59d15557460f8ecbf0bd0805f0fad5816e
3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0
44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af
5408d9f3668d380c3148ecc04f9401c082f980a88d86962bc906baf0d7abdb28
54d31025c9536bf38b4f89d7fdc5261bb87dfe924d7445a7d56b43533c86e8cb
5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
61fce8abd4bb210a64d2c15876142d0e3c1a60c8b5bb32eb48bcc241b476123f
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
8762d7fbd66b98739b325e91b8e387cb09a449e2ea2742b66a0b446542fbe34e
982e913e480e95d82865064067e2863b6a8b797e490579df06729093a87ce3fa
a05cdb61440932738c9f8dd626c06374d09919172479e3f883d011c924b5a28a
a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb
b36aacef58917c5ccd92fe91fa16ff79bd620ae549ac3d9c7f5ce8dccb6dadfb
bd7107135b50d4c7202fa8790680efa5c20a0f9e9364ca306df46c596ba3a101
ca94c95373bc5087e7c20fd142c5a6f782028777a7792b5c93870eedcdcdb25f
d75a13cddae198bbb040efae849b4daa89b3059e03d928714b074c37a4a8ecf7
ebafa00c048f458576ef2d85d734b1e533400bc1ee45b13522edf3326c47d49b
fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd