kartenabrechnunglogin.web.app Open in urlscan Pro
2620:0:890::100  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response kartenabrechnunglogin.web.app/	2 KB 2 KB	209ms 68ms	Document text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://kartenabrechnunglogin.web.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 50b3ad8f54aa922948deabda22bdc1133fbb0af76dc38c0bb6de764fbd4a795c Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 cache-control max-age=3600 content-encoding br content-length 1291 content-type text/html; charset=utf-8 date Thu, 14 Nov 2024 16:44:48 GMT etag "d20c770194979e7cd2482b296d445af7ec5fe3ec0e0af54a232408e820032e7a-br" last-modified Mon, 11 Nov 2024 06:56:10 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding x-cache HIT x-cache-hits 0 x-served-by cache-mxp6923-MXP x-timer S1731602689.948650,VS0,VE3
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	237ms 69ms	Script text/javascript	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: kartenabrechnunglogin.web.app URL: https://kartenabrechnunglogin.web.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Referer https://kartenabrechnunglogin.web.app/ Response headers content-encoding gzip age 70333 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Thu, 13 Nov 2025 21:12:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 13 Nov 2024 21:12:36 GMT last-modified Fri, 08 May 2020 07:05:03 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 31021 x-xss-protection 0 server sffe
GET H2	200	/ Show response api.ipify.org/	21 B 296 B	351ms 211ms	XHR application/json	104.26.12.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 93b5f9fdf28849c0323c71efb0c107559a28a9180d58f938982ac306c91dd2ea Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept application/json, text/javascript, */*; q=0.01 Referer https://kartenabrechnunglogin.web.app/ Response headers cf-cache-status DYNAMIC cf-ray 8e2877e9dc6eca4c-HAM access-control-allow-origin * server-timing cfL4;desc="?proto=TCP&rtt=52627&sent=7&recv=10&lost=0&retrans=0&sent_bytes=4024&recv_bytes=2254&delivery_rate=73422&cwnd=252&unsent_bytes=0&cid=4e3165d27adf606a&ts=165&x=0" content-length 21 date Thu, 14 Nov 2024 16:44:49 GMT content-type application/json vary Origin server cloudflare
GET H2	200	favicon.ico kartenabrechnunglogin.web.app/	186 KB 55 KB	70ms 61ms	Other image/x-icon	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://kartenabrechnunglogin.web.app/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c974663ab33729faae073c719b515de1751fbec1d6f54f76ce8849dbd714d914 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://kartenabrechnunglogin.web.app/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "568ba27728a203041ae5f6cfadb8eab78703e17f049afd72ab4e7d67cd2a5be7-br" x-timer S1731602689.450356,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 55719 date Thu, 14 Nov 2024 16:44:49 GMT content-type image/x-icon last-modified Mon, 11 Nov 2024 06:56:10 GMT x-served-by cache-mxp6923-MXP x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H2	200	/ Show response proxyservices.mtl2k23.workers.dev/	146 B 792 B	1175ms 476ms	XHR application/json	2606:4700:3037::ac43:9bac
General Check archive.org Show headers Download Go to Full URL https://proxyservices.mtl2k23.workers.dev/?ip=80.255.7.100 Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:9bac , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 8a706decdc65dfabd668c707d1f39dd74235c0a5784824269e2434af5d69c29d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept application/json, text/javascript, */*; q=0.01 Referer https://kartenabrechnunglogin.web.app/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z4G7Pmg4c6T1wwmkqNaZSJ7gsNFDXRWicfrwafUijoCT6feL1qRnBQS9qWLSpSfRpQkANmO9Z1tTdBEqiInu915jqWDuKNwqfUU9wgJaoayoOE98PWE1dPGw7ed37B7fZDdtzqfeK30a%2BDyZVqIP3snEfCxBcBGKEgm5E1lhKtE%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET cf-ray 8e2877f1dcc4dcc1-FRA access-control-allow-origin * alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=58648&sent=10&recv=11&lost=0&retrans=0&sent_bytes=3949&recv_bytes=2307&delivery_rate=66197&cwnd=253&unsent_bytes=0&cid=fb0f89cd940116a9&ts=480&x=0" date Thu, 14 Nov 2024 16:44:50 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lufthansa (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 string| h object| a object| j function| m object| k number| f string| c string| b function| n function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://kartenabrechnunglogin.web.app/ Message: The key "target-densitydpi" is not supported.
javascript	warning	URL: https://kartenabrechnunglogin.web.app/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://kartenabrechnunglogin.web.app/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
kartenabrechnunglogin.web.app
proxyservices.mtl2k23.workers.dev
104.26.12.205
2606:4700:3037::ac43:9bac
2620:0:890::100
2a00:1450:4001:82f::200a
50b3ad8f54aa922948deabda22bdc1133fbb0af76dc38c0bb6de764fbd4a795c
8a706decdc65dfabd668c707d1f39dd74235c0a5784824269e2434af5d69c29d
93b5f9fdf28849c0323c71efb0c107559a28a9180d58f938982ac306c91dd2ea
c974663ab33729faae073c719b515de1751fbec1d6f54f76ce8849dbd714d914
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d