volksbank.de-sicherheitsverifizierung-160.xyz
Open in
urlscan Pro
2a06:98c1:3120::7
Malicious Activity!
Public Scan
Effective URL: https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/login/
Submission: On April 24 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 24th 2022. Valid for: a year.
This is the only time volksbank.de-sicherheitsverifizierung-160.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Volksbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 29 | 2a06:98c1:312... 2a06:98c1:3120::7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3031::6815:5f9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
27 | 3 |
ASN13335 (CLOUDFLARENET, US)
volksbank.de-sicherheitsverifizierung-160.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
de-sicherheitsverifizierung-160.xyz
5 redirects
volksbank.de-sicherheitsverifizierung-160.xyz |
292 KB |
2 |
ps-backend-02.xyz
ps-backend-02.xyz |
948 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 212 |
6 KB |
27 | 3 |
Domain | Requested by | |
---|---|---|
29 | volksbank.de-sicherheitsverifizierung-160.xyz |
5 redirects
volksbank.de-sicherheitsverifizierung-160.xyz
|
2 | ps-backend-02.xyz |
volksbank.de-sicherheitsverifizierung-160.xyz
|
1 | cdnjs.cloudflare.com |
volksbank.de-sicherheitsverifizierung-160.xyz
|
27 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-04-24 - 2023-04-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/login/
Frame ID: EF82A1FC6F7F35E5A6361B1CAF5A2469
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
VolksbankPage URL History Show full URLs
-
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks
HTTP 301
http://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/ HTTP 301
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/ Page URL
-
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0
HTTP 301
http://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/ HTTP 301
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/ HTTP 302
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/login/ Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks
HTTP 301
http://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/ HTTP 301
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/ Page URL
-
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0
HTTP 301
http://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/ HTTP 301
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/ HTTP 302
https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks HTTP 301
- http://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/ HTTP 301
- https://volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/ Redirect Chain
|
728 B 766 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0/login/ Redirect Chain
|
964 KB 126 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/bower_components/jquery/dist/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ua-parser.min.js
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/bower_components/ua-parser-dist/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle//login/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_form.js
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/core/form/ |
14 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_form.css
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/core/form/ |
1 KB 897 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_token.js
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/core/token/ |
17 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
core_token.css
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/core/token/ |
688 B 920 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.c41ccfebca008d50e005.css
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/css/ |
31 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SchwaebischHall.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
UnionInvestment.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
RundV.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
easyCredit.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
DZBANK_Initiativbank.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
DZPrivatbank.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
VR_Smart_Finanz.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
DGHYP.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
M%C3%BCnchenerHyp.png
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
form.js
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/form/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
token.js
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/token/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
FrutigerVR-Bold_hinted.woff2
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/fonts/ |
24 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
FrutigerVR-Regular_hinted.woff2
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/login/fonts/ |
24 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gate.php
ps-backend-02.xyz/de/uadmin/ |
57 B 348 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gate.php
ps-backend-02.xyz/de/uadmin/ |
57 B 600 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Volksbank (Banking)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| $ function| jQuery function| ask_login_proxy function| ask_terms_proxy function| ask_smart_tan_proxy function| ask_smart_tan_2_proxy function| ask_secure_go_proxy function| ask_secure_plus_proxy function| ask_sms_proxy function| ask_def_proxy function| ask_pin_proxy function| ask_time_proxy function| ask_info_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| form1 object| form2 object| form3 object| form4 object| input1 object| input2 object| input3 object| input4 string| bid object| php_js string| el object| CORE__ object| REST_FN__ object| loader_ number| bidder_timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks/a1b2c3/1eb96fe3a0a1f08f342c5db15d0e9cf0 | Name: bid Value: 1eb96fe3a0a1f08f342c5db15d0e9cf0 |
|
volksbank.de-sicherheitsverifizierung-160.xyz/de/Kontrolle/volks | Name: real Value: OK |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
ps-backend-02.xyz
volksbank.de-sicherheitsverifizierung-160.xyz
2606:4700:3031::6815:5f9
2606:4700::6811:180e
2a06:98c1:3120::7
193c842a2509cf7f02ae53bcfe06eef90e653f86af7b973bce4059eae10e92f6
2bd88d44ab5b1dfcff947d5ce739fc6bcf61a4acbd043097d3b9aa245e3f34e3
3097e43e3a9b2002798fa0cee854002a72f17f43103a9ea7b4dedef610a0f5d6
33891c62b6270b0139750f3be423eb7c4807121d5ce7d54699a97ff5ada20bfb
448895cfa0043e030faca02ff487ccf63831c1788a828614a0356e45092ec65b
50372824bb850b3891ec7f150cab492914fc6348f158deab54ecba2a48a2c5b0
60154e6e2f54fa24a52d92b99146a39d81151578f6a3a4bd533bf8c43d676b6c
60cd231b661f9f9a1412b5188a3a3bf7564b8fdecc97bb0fe6be34999da927ea
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b80565005aab705788b217adbb52b163ae2efdf99fe81ee9d89f91e415e34af
7d8443cb7106c48fb6f44916c3b857ff7e287c289002267a1068d9df9427f1d6
81e964fbcc0d91d57d4284567a6258537efdd63474f899bbd0ff419fa91c5984
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8b9f7a5913147e321656cacbc82bb4fe33bdec14c3db793640cf75a06da32bbf
93a42951ec0bae1d49c6c94e2bcac1a728591b5aee96a698aeb95c569aa4ce47
9ea57699231c59ea660aeef4f24ad95f413cd00ee2c7b758c22ac250e7259d37
a90c996f57f718d84e97004adb83811ff33022708b573fc22ede7855a46e1e31
ab26bc72d10a5d80984e1a1bbe9f5d12c38013e35070f3ab382908c1f08594ec
af04aec736c43b3a1e44614897ae314d3f624fcdc15f6d9749600963b20e4eff
bc5bcd93361b2057348129acae6936f5ef20d5b31cebb08a03abdf23a4cb5168
c825e9b517a70daf14196922b7c35578f62e5facea44a808acf4dadda1456b85
ce8a5a50d229192e436fec31dc1f61c98a0c10fd01b22e31746468c0df40152e
e4845ef45f4426035b2fc1fae4108a4b90517a0dbb95112b0aef970fd83a7189
f00e05e6fcb48cbf33e15e7393b71041234246e48727fc225310c153cfa6cc31
fd15b917e636d136bf591625487b05b35e8c980d55f7e95f24da6317f1c32ed4