sankang-germany.de
Open in
urlscan Pro
212.8.206.132
Malicious Activity!
Public Scan
URL:
http://sankang-germany.de/wp-content/upgrade/step2.php?cmd=login_submit&id=03364bae4b25f9edc0a57c204ddf2c0003364bae4b2...
Submission: On June 25 via automatic, source phishtank
Submission: On June 25 via automatic, source phishtank
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 18 HTTP transactions.
The main IP is 212.8.206.132, located in
Germany and
belongs to TEUTONET-AS, DE.
The main domain is sankang-germany.de.
This is the only time sankang-germany.de was scanned on urlscan.io!
This is the only time sankang-germany.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Bank of America (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 17 | 212.8.206.132 212.8.206.132 | 8925 (TEUTONET-AS) (TEUTONET-AS) | |
| 1 | 54.148.84.95 54.148.84.95 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 18 | 2 |
17
212.8.206.132
(Germany)
ASN8925 (TEUTONET-AS, DE)
PTR: mailadmin.greentomato.de
ASN8925 (TEUTONET-AS, DE)
PTR: mailadmin.greentomato.de
| sankang-germany.de |
1
54.148.84.95
(Boardman, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
| www.sitepoint.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 17 |
sankang-germany.de
sankang-germany.de |
47 KB |
| 1 |
sitepoint.com
www.sitepoint.com |
6 KB |
| 18 | 2 |
| Domain | Requested by | |
|---|---|---|
| 17 | sankang-germany.de |
sankang-germany.de
|
| 1 | www.sitepoint.com |
sankang-germany.de
|
| 18 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sitepoint.com SSL.com Premium EV CA |
2018-08-07 - 2019-09-23 |
a year | crt.sh |
| 1970-01-01 - 1970-01-01 |
a few seconds | crt.sh |
This page contains 1 frames:
Primary Page:
http://sankang-germany.de/wp-content/upgrade/step2.php?cmd=login_submit&id=03364bae4b25f9edc0a57c204ddf2c0003364bae4b25f9edc0a57c204ddf2c00&session=03364bae4b25f9edc0a57c204ddf2c0003364bae4b25f9edc0a57c204ddf2c00
Frame ID: A618CD5CF3973881EB2E2674339BD636
Requests: 18 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Ubuntu
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Ubuntu/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
step2.php
sankang-germany.de/wp-content/upgrade/ |
23 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a1.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
d15.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
d14.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a6.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a5.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b8.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bo28.png
sankang-germany.de/wp-content/upgrade/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bo29.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b7.png
sankang-germany.de/wp-content/upgrade/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b9.png
sankang-germany.de/wp-content/upgrade/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b10.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bo7.png
sankang-germany.de/wp-content/upgrade/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a4.png
sankang-germany.de/wp-content/upgrade/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a3.png
sankang-germany.de/wp-content/upgrade/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a2.png
sankang-germany.de/wp-content/upgrade/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cnf.png
sankang-germany.de/wp-content/upgrade/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Bank of America (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| MaskedPassword function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sankang-germany.de
www.sitepoint.com
212.8.206.132
54.148.84.95
0c7ed3370512367908fe736b96e01a877c0d642a6a89ad21bf00c7759d4d9f78
116ff2601fa34b6d7c08cf7ed67796b1949c32a643845727a049a6a6ecc75d48
13d52d8aa36cb38261ad4dbe587869ed3c31c7af7d62bc7239e01acc68b687bb
2dd4abf9a3e19a2cc521052355922553e8515100f4da4cfd19a3b4e1cffe1b0e
3f30a8aab972b0b808073478b3fc31648e60731750064d638445d8ad4ff63bc3
4030e0d39cb2a464636fd9610276a3d005a83a33f8ce86b829c9d1b34a594fb4
40784ccba851d649ae89f757b9768bbfbb63345ba70266c1d87be61cf4e9e9a9
419c1039a251761864dd896d053e33afc4a31b0d3de682527391d2bc4cee4954
44f9fcdaf0581ddbb603c540f544773de770ced3444d0af611705a7dedc6cdfc
66b07bc89b7918c6f31fb5b3504a2b182a62560f070c7af878beb8aa407b8bbf
66d433b8f43605625a44fe7184bd93e761789bd67b70cb57d20d9c863d11518c
69ed12ae7471b9f39a9b9363243782366bf69257d8d766a5f4b887bc0aac6a0d
70141e64223d3aec9ee9367352f5e9a2d92ae0e236d56b52f8e73e08a918cb2c
7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a
782c9ad49bcdf749a1b40dcd8fbdf20f0e016f95fbd7520d823810432a9b1194
d32527a3374bdd83ee998af5f6242651354d5d0091bb4f83dcf2b808be5b1841
d64b6a85b63167156bd441c676ce907d286b3e3e0e94d2dc07a7cf18b9fce417
df51b95082d4379b49a85ddcf4a8a0e0108f0aa2b519226f76df3446bfd7e3b9