citizenclothingshop.com Open in urlscan Pro
2606:4700:3032::ac43:923f Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://citizenclothingshop.com/DKB/Loginfirst.php
Submission: On September 17 via automatic, source phishtank (September 17th 2023, 3:53:11 pm UTC) — Scanned from DE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 19 HTTP transactions. The main IP is 2606:4700:3032::ac43:923f, located in United States and belongs to CLOUDFLARENET, US. The main domain is citizenclothingshop.com.
TLS certificate: Issued by E1 on August 11th 2023. Valid for: 3 months.

This is the only time citizenclothingshop.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

	IP Address	AS Autonomous System
12	2606:4700:303... 2606:4700:3032::ac43:923f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	162.19.58.159 162.19.58.159	16276 (OVH) (OVH)
19	5

12 2606:4700:3032::ac43:923f (United States)

ASN13335 (CLOUDFLARENET, US)

citizenclothingshop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.19.58.159 (France)

ASN16276 (OVH, FR)
PTR: ns3096667.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	citizenclothingshop.com citizenclothingshop.com	38 KB
3	ibb.co i.ibb.co — Cisco Umbrella Rank: 11592	2 MB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 364	41 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3038	16 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 918	30 KB
19	5

	Domain	Requested by
12	citizenclothingshop.com	citizenclothingshop.com
3	i.ibb.co	citizenclothingshop.com
2	cdn.jsdelivr.net	citizenclothingshop.com
1	stackpath.bootstrapcdn.com	citizenclothingshop.com
1	code.jquery.com	citizenclothingshop.com
19	5

This site contains no links.

Subject Issuer	Validity	Valid
citizenclothingshop.com E1	`2023-08-11` - `2023-11-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
ibb.co R3	`2023-08-10` - `2023-11-08`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://citizenclothingshop.com/DKB/Loginfirst.php
Frame ID: 5F795BDB1355AA6637C20C4B31D73B83
Requests: 13 HTTP requests in this frame

Frame: https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/saved_resource(1).html
Frame ID: 084DB8CA4DBD14E40777EED044E87F98
Requests: 2 HTTP requests in this frame

Frame: https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/saved_resource(2).html
Frame ID: 91998013C8573E626243329EB79E739F
Requests: 2 HTTP requests in this frame

Frame: https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/c7de60f8e486341024c609f38e44b314e04aab37.html
Frame ID: 65C6A5F104613A78B391C9295EC7E505
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DKB - Deutsche Kreditbank AG - Internet BankingDKB Logo

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

19
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1819 kB
Transfer

2171 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request Loginfirst.php Show response
citizenclothingshop.com/DKB/ 34 KB
8 KB 435ms
346ms Document
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20ab0a8eea9f05cbfb70d53c6c6b78c8c0bd62ed591d63bca4fdc067a6644905

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 808285285df118fd-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 17 Sep 2023 15:53:06 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BSkIALj72nw6txrtJBj8gSf%2Bb2TWDVqP9STwNCh4EaOlCTX6FyyhEMlvUXYcJvZVu9fds54xpOUv%2F0l79u%2BLqD8vjiUKmqmv0tmMLKXQGzXFLN0WtgYT8xk3lPDQyKnRsSGDrNk%2FDdslA55Iv3NguBctVgAZjg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 404 dkb-global.css
citizenclothingshop.com/DKB/DKB%20-%20Deutsche%20Kreditbank%20AG%20-%20Internet%20Banking_files/ 0
0 335ms
328ms Stylesheet
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizenclothingshop.com/DKB/DKB%20-%20Deutsche%20Kreditbank%20AG%20-%20Internet%20Banking_files/dkb-global.css
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l8M%2B7Z7E2M6%2B3jYUfDKFgGHcXpR%2BHlNl181crDix%2Fme%2F%2BuFiZsLKHHfAotIvxstDOf%2BhKCsBl6epWJ7gTTsbCagjjo%2Bb7cta%2FA4VGdLIv8IVNzHvUWHtxqkbLfj3HNQKK6Nib5%2FWHxWMFpIXWccVJ5y000fKjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 8082852a998518fd-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.1/dist/css/ 227 KB
33 KB 91ms
35ms Stylesheet
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.1/dist/css/bootstrap.min.css

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d939d21f27010c09b6c2966681d8b4cfcd64ca418f240922518f967fded16ef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizenclothingshop.com/
Origin: https://citizenclothingshop.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1429019
x-jsd-version: 5.3.1
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230044-FRA, cache-jnb7025-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"38d97-sT73BUPXDB7H/dVqXrydfWQCOFE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8%2FMqOEWdP83L%2FPpkWTG3UtIJR9y52aez70r6FejceAMKi9EhsQl6%2FQLvRR%2BJvOjJcKuE%2Fk%2FE5RrVevyE9Ai3WyYmKeZ4VKnnubiD1F0K%2Fju22iP5FcAGLYOPvJ%2BkbVNviuInLuJW87QMdFcrYYc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 8082852aea311911-FRA

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 73ms
20ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 163789
x-cache: HIT, HIT
content-length: 30879
x-served-by: cache-lga13628-LGA, cache-fra-eddf8230077-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1694965987.021816,VS0,VE0
etag: W/"28feccc0-15d84"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 43, 75014

GET
H2 200 popper.min.js Show response
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ 21 KB
8 KB 108ms
55ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 17911170
x-jsd-version: 1.16.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230104-FRA, cache-yyz4525-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Ze915yA0CVr%2BxggNqVMjXBiVwkxoJVMnUCn2rM3szec1LI%2FRRS%2FmlI6%2BAuiVFmXpd6cLD1blc2%2FX2VPAPWTs5rJyPjVsqqBJufiRiVYI2JPCUPWU8pN7jtqp7lKWuHfZBnpy%2BzKEMIA6U71JPc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 8082852aeb9c39d6-FRA

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/ 59 KB
16 KB 86ms
30ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 718, 718
age: 22167902
cdn-cachedat: 2021-04-13 02:26:44
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:10 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: efc6e8ba47328ad09f4961d07c15198f
timing-allow-origin: *
cdn-requestcountrycode: US
cf-ray: 8082852aea3e2c7e-FRA
cdn-requestpullsuccess: True

GET
H2 200 arcotfpcollect.js.t%C3%A9l%C3%A9chargement Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ 5 KB
1 KB 198ms
194ms Script
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3USW1QyXlShL9MD65JoKFiXQZ2mJeHu45L2pSTs3R64J01K6fltkPm6qnfX1pJ63CzLF8IN9NThO0I8JNFd9f8L7fNbMqq%2Fsxnqbf4ym5GLQgALqbnRuVj6GtIqGZdPEvM4Z92NBGVzymx2YBwhOmQGt4f7QEw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-ray: 8082852a998718fd-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H2 200 collectddna.js.t%C3%A9l%C3%A9chargement Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ 5 KB
1 KB 366ms
362ms Script
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1gSus8blkD0SQacCRDp22K0C7PyOY4GNTQHKkjGt0Q0Sbx9I43Y1Fw%2Bq51vSeSdP3HPiOfVooGFaIZ0r%2Fkyrzi%2FU6mRsOBWlUjlg1EHgripAW0%2F5VFfq598NoOPjOGEC4rgsdn6dHe7DkTn0yaxLeWyTW1R71Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-ray: 8082852a998818fd-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H2 200 proxyid.js.t%C3%A9l%C3%A9chargement Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ 5 KB
1 KB 344ms
340ms Script
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3gIGcPcTdB4G9wad0%2FFY4yqaqqBjqKJCxz%2Bqh5WwPVhgsDrPLinUdwNdHjrwFX6118yoYgh%2BBxNmLAo3onWKQnZTKV2f%2B3%2FYB%2BlDM507vzWtEGHAlwIgpCjkaREbHQXam6sir6j9o3c%2BXgmqVnEWAcMvynQ7BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-ray: 8082852a998a18fd-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H2 200 28459.js.t%C3%A9l%C3%A9chargement Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ 5 KB
1 KB 366ms
363ms Script
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/28459.js.t%C3%A9l%C3%A9chargement

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ji7i6M2q5XBajti%2FjiPCm1s7uBynkDRo969B0%2BZrZRfSArUncuCgaUqa7GiZPT09KnmsIVYEORXEf5ys6OIex2c0E3jXxsUjiglR4zdmxG5rBIMEYRg7j43RhfpdMtrbG7uyrC4jul0vxTidWoWX5DouE9NT4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-ray: 8082852a998b18fd-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H2 200 0
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ 5 KB
5 KB 334ms
332ms Image
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/0

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zGyibrbvB7orEZA%2B5FWxN%2FMOPEcgqeW21kQVI6VnCEUYaMJaJVpG6HabgXb6vJWD%2FOdgL665hlfEt%2FkIIsQrsuvxriAXzmsiSAQ2vFoRw%2FoYjUXU5615yk%2BoYGSa0C5FS8zPBGCM3zcBQ6sCS6IEBuhpZ2oK6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
cf-ray: 8082852a998f18fd-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 404 dkb-global-print.css
citizenclothingshop.com/DKB/DKB%20-%20Deutsche%20Kreditbank%20AG%20-%20Internet%20Banking_files/ 0
0 344ms
340ms Stylesheet
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizenclothingshop.com/DKB/DKB%20-%20Deutsche%20Kreditbank%20AG%20-%20Internet%20Banking_files/dkb-global-print.css
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5aJymw%2FYTHjVqu05mGZKxcn%2B14taXoIoP7V2USIypQ6f4pf6kcBZqQz8bTNYRajwN6B7WgC06EeaCjaIKqvmH7LgiOXzoefUPDvf1HojRo4uE8%2BxF83TLuIsvmSyXnSu%2FZdRSfeNae%2FM1MJrrZ4I58OTJTOHag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 8082852caa663a49-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 imgbac.jpg
citizenclothingshop.com/DKB/ 14 KB
15 KB 32ms
32ms Image
image/jpeg 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citizenclothingshop.com/DKB/imgbac.jpg
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8acf454559e66f5d858a9fc8d0ecc1ec8d612a7af422bdeca50f5d4e1521cd3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 142745
alt-svc: h3=":443"; ma=86400
content-length: 14314
pragma: public
last-modified: Sat, 29 Jul 2023 21:37:26 GMT
server: cloudflare
etag: "64c58696-37ea"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=04YnYnY%2BS%2BFtNzZvGWexpETjKtQvFch3Y2c9%2FjG9ex89wig2Xp0h6wteMRYSh%2BAYJVeE5w%2FBvzmRSACAre%2BIVYxTY9TO%2BeYiYYsj01vKymOxdEU1bB%2BkiUCnu0JtBXrQeUkRdlXQKH1jOvd5e2S%2BSNiQ7JmnHg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=2592000, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 8082852d0b0c3a49-FRA
expires: Mon, 16 Oct 2023 00:14:02 GMT

GET
H3 200 saved_resource(1).html Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ Frame 084D 5 KB
2 KB 367ms
367ms Document
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/saved_resource(1).html

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8082852d2b2c3a49-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 17 Sep 2023 15:53:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VFysOQCgv6%2FAoqeq89MoZpl8HBVwy%2FyJTlNtwDJffPjl0f%2BrUV4doyhg2XYlnplQQcHZPpb7eyXOe4Z9ExpLabT1r92RGknmeRr%2F5fnqC01QhKpZiTd%2BLxD2axqZLPais3sm5E4y4uhHuRoeYfZhwN611q3FqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H3 200 saved_resource(2).html Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ Frame 9199 5 KB
2 KB 360ms
359ms Document
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/saved_resource(2).html

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8082852d2b333a49-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 17 Sep 2023 15:53:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EHfcGScH%2B0hzPF6xnTtO44x5sVqXbUHWUraODOMOM8%2BzCjp8%2F2ktN%2BEuNRzZB6RQxDBMkgJU0XKSGyHEZzSZT8Vsey6cx%2BpmELPSjivPQ12DFtN3I%2BM92pWtl5%2F%2BUcshno71QVRm0718fGHjcdbiRQgnXqcVUA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H3 200 c7de60f8e486341024c609f38e44b314e04aab37.html Show response
citizenclothingshop.com/DKB/Je%20me%20connecte_files/ Frame 65C6 5 KB
2 KB 335ms
334ms Document
text/html 2606:4700:3032::ac43:923f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/c7de60f8e486341024c609f38e44b314e04aab37.html

Requested by

Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Loginfirst.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:923f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://citizenclothingshop.com/DKB/Loginfirst.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8082852d2b3c3a49-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 17 Sep 2023 15:53:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pl3MZ%2F5OTaBKufkdB8TKAKPtOV%2FtYdbqGXC7WNMo6Tanm9OERPSnwexX7Fj6Cu%2Bp8Abb0nXnfEg8gD2rok44RlOUeZUGT3%2FZPluqbC9%2FtZJguSg9vr059ZUiYB49z47c8W79g5v3FL3kV3%2B2KQahe1a17DrUzA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 Cyb3r-Drag0nz-Team.png
i.ibb.co/DC6YMjP/ Frame 65C6 564 KB
565 KB 98ms
31ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/DC6YMjP/Cyb3r-Drag0nz-Team.png
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/c7de60f8e486341024c609f38e44b314e04aab37.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: d1e6a4b015f53bd91f71d85f16b3ea0c346224a8c23de1064cf82e04c946279b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
last-modified: Sat, 05 Aug 2023 13:53:51 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 577196
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Cyb3r-Drag0nz-Team.png
i.ibb.co/DC6YMjP/ Frame 9199 564 KB
565 KB 74ms
31ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/DC6YMjP/Cyb3r-Drag0nz-Team.png
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/saved_resource(2).html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: d1e6a4b015f53bd91f71d85f16b3ea0c346224a8c23de1064cf82e04c946279b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
last-modified: Sat, 05 Aug 2023 13:53:51 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 577196
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Cyb3r-Drag0nz-Team.png
i.ibb.co/DC6YMjP/ Frame 084D 564 KB
565 KB 69ms
30ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/DC6YMjP/Cyb3r-Drag0nz-Team.png
Requested by: Host: citizenclothingshop.com
URL: https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/saved_resource(1).html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: d1e6a4b015f53bd91f71d85f16b3ea0c346224a8c23de1064cf82e04c946279b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://citizenclothingshop.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 15:53:07 GMT
last-modified: Sat, 05 Aug 2023 13:53:51 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 577196
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DKB (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			citizenclothingshop.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: vl21ffo25ioa93dpq97g552mfn

24 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://citizenclothingshop.com/DKB/DKB%20-%20Deutsche%20Kreditbank%20AG%20-%20Internet%20Banking_files/dkb-global.css Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/28459.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/arcotfpcollect.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/collectddna.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://citizenclothingshop.com/DKB/Loginfirst.php Message: Refused to execute script from 'https://citizenclothingshop.com/DKB/Je%20me%20connecte_files/proxyid.js.t%C3%A9l%C3%A9chargement' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://citizenclothingshop.com/DKB/DKB%20-%20Deutsche%20Kreditbank%20AG%20-%20Internet%20Banking_files/dkb-global-print.css Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
citizenclothingshop.com
code.jquery.com
i.ibb.co
stackpath.bootstrapcdn.com
162.19.58.159
2606:4700:3032::ac43:923f
2606:4700::6810:5514
2606:4700::6812:bcf
2a04:4e42:600::649
20ab0a8eea9f05cbfb70d53c6c6b78c8c0bd62ed591d63bca4fdc067a6644905
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
967c6424260e1dd3228f98e5dfe8bb7934976306819c64506cc63f7af2eccdbc
a8acf454559e66f5d858a9fc8d0ecc1ec8d612a7af422bdeca50f5d4e1521cd3
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
d1e6a4b015f53bd91f71d85f16b3ea0c346224a8c23de1064cf82e04c946279b
d939d21f27010c09b6c2966681d8b4cfcd64ca418f240922518f967fded16ef6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

citizenclothingshop.com Open in urlscan Pro 2606:4700:3032::ac43:923f Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

1819 kBTransfer

2171 kBSize

1 Cookies

0 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

24 Console Messages

Security Headers

Indicators

citizenclothingshop.com Open in urlscan Pro
2606:4700:3032::ac43:923f Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1819 kB
Transfer

2171 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!