spk-kundencenter-de-safe-redirect-home-portal.ru Open in urlscan Pro
91.92.109.167 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://shrt.es/KzjoS
Effective URL:
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/
Submission Tags: 6759174
Submission: On September 05 via api (September 5th 2020, 6:50:23 pm UTC) from NL

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 3 countries across 3 domains to perform 20 HTTP transactions. The main IP is 91.92.109.167, located in Bulgaria and belongs to NETERRA-AS, BG. The main domain is spk-kundencenter-de-safe-redirect-home-portal.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 11th 2020. Valid for: 3 months.

This is the only time spk-kundencenter-de-safe-redirect-home-portal.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	188.94.254.137 188.94.254.137	15817 (MITTWALD-...) (MITTWALD-AS Mittwald CM Service GmbH und Co. KG)
1 1	2606:4700:303... 2606:4700:3035::681c:b37	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 24	91.92.109.167 91.92.109.167	34224 (NETERRA-AS) (NETERRA-AS)
20	1

1 188.94.254.137 (Germany) 1 redirects

ASN15817 (MITTWALD-AS Mittwald CM Service GmbH und Co. KG, DE)

shrt.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::681c:b37 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ug-ltd.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 91.92.109.167 (Bulgaria) 4 redirects

ASN34224 (NETERRA-AS, BG)
PTR: physc.sofhat.com

spk-kundencenter-de-safe-redirect-home-portal.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	spk-kundencenter-de-safe-redirect-home-portal.ru 4 redirects spk-kundencenter-de-safe-redirect-home-portal.ru	325 KB
1	ug-ltd.xyz 1 redirects ug-ltd.xyz	806 B
1	shrt.es 1 redirects shrt.es	275 B
20	3

	Domain	Requested by
24	spk-kundencenter-de-safe-redirect-home-portal.ru	4 redirects spk-kundencenter-de-safe-redirect-home-portal.ru
1	ug-ltd.xyz	1 redirects
1	shrt.es	1 redirects
20	3

This site contains no links.

Subject Issuer	Validity	Valid
spk-kundencenter-de-safe-redirect-home-portal.ru Let's Encrypt Authority X3	`2020-08-11` - `2020-11-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/
Frame ID: E9AB72DED3B0F15942008D0EED5D0255
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://shrt.es/KzjoS HTTP 301
https://ug-ltd.xyz/Slft41F HTTP 302
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/ HTTP 302
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a HTTP 301
http://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/ HTTP 301
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/ HTTP 302
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/ Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

3
Countries

324 kB
Transfer

500 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shrt.es/KzjoS HTTP 301
https://ug-ltd.xyz/Slft41F HTTP 302
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/ HTTP 302
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a HTTP 301
http://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/ HTTP 301
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/ HTTP 302
https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/ Redirect Chain https://shrt.es/KzjoS https://ug-ltd.xyz/Slft41F https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/ https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a? http://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/? https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/? https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/?	17 KB 5 KB	163ms 162ms	Document text/html	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `69103444fe79a8e12842f03660dcdf5122a2c507422d5402a32f238f61f2fee1` Request headers Host spk-kundencenter-de-safe-redirect-home-portal.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie bid=03d8a746892d3f3bfeb7f9405ff5cc4a Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx/1.10.3 (Ubuntu) Date Sat, 05 Sep 2020 18:50:06 GMT Content-Type text/html; charset=UTF-8 Content-Length 4700 Connection keep-alive Set-Cookie PHPSESSID=do1b18kng27l40n5872sekshm1; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Redirect headers Server nginx/1.10.3 (Ubuntu) Date Sat, 05 Sep 2020 18:50:06 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive Set-Cookie bid=03d8a746892d3f3bfeb7f9405ff5cc4a location login/?
GET H/1.1	200 OK	jquery.min.js Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/jquery/dist/	85 KB 30 KB	248ms 167ms	Script application/javascript	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/jquery/dist/jquery.min.js Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Last-Modified Thu, 27 Feb 2020 17:27:42 GMT Server nginx/1.10.3 (Ubuntu) ETag "15283-59f9209cc9f80-gzip" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 30138
GET H/1.1	200 OK	ua-parser.min.js Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/ua-parser-js/dist/	17 KB 6 KB	237ms 152ms	Script application/javascript	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Last-Modified Thu, 27 Feb 2020 17:27:44 GMT Server nginx/1.10.3 (Ubuntu) ETag "4298-59f9209eb2400-gzip" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 6063
GET H/1.1	200 OK	font-awesome.min.css spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/font-awesome/css/	30 KB 7 KB	158ms 156ms	Stylesheet text/css	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Last-Modified Thu, 27 Feb 2020 17:27:40 GMT Server nginx/1.10.3 (Ubuntu) ETag "7918-59f9209ae1b00-gzip" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 7053
GET H/1.1	200 OK	css.css spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/form/	557 B 557 B	226ms 149ms	Stylesheet text/css	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/form/css.css Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `117bce8813acf5c9ee88220b82297dcbec9fd00f46178e6a78d0533b9252f276` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Last-Modified Tue, 03 Mar 2020 09:16:50 GMT Server nginx/1.10.3 (Ubuntu) ETag "22d-59fefc387a480-gzip" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 254
GET H/1.1	200 OK	style.php spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	73 KB 11 KB	244ms 167ms	Stylesheet text/css	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `b87d2aaa6bb1dd568673b4cdc22bd6e1cf278710779f0e407642fed6e61cfd64` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Server nginx/1.10.3 (Ubuntu) Vary Accept-Encoding Content-Type text/css;charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 10608 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	spk-logo-desktop.png spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	7 KB 7 KB	152ms 150ms	Image image/png	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/spk-logo-desktop.png Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `a4f04574b20972a5b290984c214ff23af7810b73db0a640c75bf11b2a042336b` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Last-Modified Thu, 27 Feb 2020 17:27:24 GMT Server nginx/1.10.3 (Ubuntu) ETag "1bb5-59f9208b9f700" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 7093
GET H/1.1	200 OK	spk-logo-mobile.png spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	5 KB 5 KB	148ms 147ms	Image image/png	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/spk-logo-mobile.png Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `723733a7bb6f25194a40769ba4b2c4b4840d707bba89f745984fab9442f72141` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Last-Modified Thu, 27 Feb 2020 17:27:24 GMT Server nginx/1.10.3 (Ubuntu) ETag "146c-59f9208b9f700" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 5228
GET H/1.1	200 OK	spk-logo-druck.png spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	6 KB 6 KB	143ms 142ms	Image image/png	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/spk-logo-druck.png Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `92a47005456ffc3265cfb02b76cfb77edf109347cd59ef3c755aec4ffd4e8e85` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Last-Modified Thu, 27 Feb 2020 17:27:24 GMT Server nginx/1.10.3 (Ubuntu) ETag "18d5-59f9208b9f700" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 6357
GET H/1.1	404 Not Found	tdg spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	310 B 310 B	380ms 140ms	Image text/html	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/tdg Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `4aea18f209023234a92e63a8a1f66e0c4b85a031391792e81d39f8f3901a13f0` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Content-Encoding gzip Server nginx/1.10.3 (Ubuntu) Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	form.js Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/form/	9 KB 3 KB	151ms 151ms	Script application/javascript	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/form/form.js?v=5f53ddde66e34 Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `47c4c7b3fddbf6b4c854f09c3d434da26826a2affeca30874e1846ce275b3bc0` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Last-Modified Thu, 27 Feb 2020 17:27:34 GMT Server nginx/1.10.3 (Ubuntu) ETag "2535-59f9209528d80-gzip" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 2801
GET H/1.1	200 OK	token.js Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/token/	11 KB 2 KB	145ms 145ms	Script application/javascript	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/token/token.js?v=5f53ddde66e85 Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `0e322d75e7e6d86475f347f96a1f770a17025eec6070a0d8735177af29094d8a` Request headers Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:06 GMT Content-Encoding gzip Last-Modified Tue, 03 Mar 2020 10:09:42 GMT Server nginx/1.10.3 (Ubuntu) ETag "2a6a-59ff080988580-gzip" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 1782
GET H/1.1	200 OK	25frrutigerltw02-55roman-webfont.woff spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/fonts/reg/	25 KB 25 KB	176ms 143ms	Font application/font-woff	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/fonts/reg/25frrutigerltw02-55roman-webfont.woff Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `7cc0a4759f5cfe7d8a6f191f79a38b1c8e36c975f160b89f21d31436dff05c4e` Request headers Origin https://spk-kundencenter-de-safe-redirect-home-portal.ru Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Last-Modified Sun, 01 Mar 2020 13:29:08 GMT Server nginx/1.10.3 (Ubuntu) ETag "62e4-59fcb0e247100" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 25316
GET H/1.1	200 OK	pictos-if.woff spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	64 KB 64 KB	226ms 155ms	Font application/font-woff	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/pictos-if.woff Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `d6fff4dce0ed66b0ef96ec5165e4b5fa7d2d193df2537040630dd19606b7b664` Request headers Origin https://spk-kundencenter-de-safe-redirect-home-portal.ru Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Last-Modified Thu, 27 Feb 2020 17:27:22 GMT Server nginx/1.10.3 (Ubuntu) ETag "ff6c-59f92089b7280" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 65388
GET H/1.1	200 OK	25frrutigerltw02-65bold-webfont.woff spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/fonts/bold/	25 KB 26 KB	258ms 142ms	Font application/font-woff	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/fonts/bold/25frrutigerltw02-65bold-webfont.woff Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `353b8f56926b58e1c037ac912432156fff183d03d5f42a1f5d2ec06199e446f4` Request headers Origin https://spk-kundencenter-de-safe-redirect-home-portal.ru Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Last-Modified Sun, 01 Mar 2020 13:29:00 GMT Server nginx/1.10.3 (Ubuntu) ETag "6574-59fcb0daa5f00" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 25972
GET H/1.1	200 OK	password.ttf spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/	125 KB 125 KB	239ms 143ms	Font application/font-sfnt	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/password.ttf Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `5585d482c2eee6acbeca5fe3d9ffaad32b15c5b26995ee345b0208f557571155` Request headers Origin https://spk-kundencenter-de-safe-redirect-home-portal.ru Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/login/style.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Last-Modified Tue, 03 Mar 2020 09:02:34 GMT Server nginx/1.10.3 (Ubuntu) ETag "1f2fc-59fef90821e80" Content-Type application/font-sfnt Connection keep-alive Accept-Ranges bytes Content-Length 127740
GET H/1.1	200 OK	home.php Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/	57 B 220 B	296ms 273ms	XHR application/json	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/home.php?link=sparkase.de&bid=03d8a746892d3f3bfeb7f9405ff5cc4a&callback=jQuery32108485019396027467_1599331806854&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1599331806855 Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `8038a801db146c04dfba811a22ec2971ebbdc49e9fd483cd4f48c20883b4c73a` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Server nginx/1.10.3 (Ubuntu) Connection keep-alive Content-Length 57 Content-Type application/json
GET H/1.1	200 OK	home.php Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/	57 B 220 B	304ms 278ms	XHR application/json	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/home.php?link=sparkase.de&bid=03d8a746892d3f3bfeb7f9405ff5cc4a&callback=jQuery32108485019396027467_1599331806856&data=%7B%22mes%22%3A%22User%20on%20Login%20page%22%7D&_=1599331806857 Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `3f8e2a411c72d15c52e277ce9ded5ad2ea9ebc8491a9b0b4dfd7403fa4db81ca` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:07 GMT Server nginx/1.10.3 (Ubuntu) Connection keep-alive Content-Length 57 Content-Type application/json
GET H/1.1	200 OK	home.php Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/	57 B 220 B	308ms 308ms	XHR application/json	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/home.php?link=sparkase.de&bid=03d8a746892d3f3bfeb7f9405ff5cc4a&callback=jQuery32108485019396027467_1599331806856&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1599331806858 Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `3f8e2a411c72d15c52e277ce9ded5ad2ea9ebc8491a9b0b4dfd7403fa4db81ca` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:12 GMT Server nginx/1.10.3 (Ubuntu) Connection keep-alive Content-Length 57 Content-Type application/json
GET H/1.1	200 OK	home.php Show response spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/	57 B 220 B	328ms 327ms	XHR application/json	91.92.109.167 NETERRA-AS
General Check archive.org Show headers Download Go to Full URL https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/home.php?link=sparkase.de&bid=03d8a746892d3f3bfeb7f9405ff5cc4a&callback=jQuery32108485019396027467_1599331806856&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1599331806859 Requested by Host: spk-kundencenter-de-safe-redirect-home-portal.ru URL: https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.92.109.167 , Bulgaria, ASN34224 (NETERRA-AS, BG), Reverse DNS physc.sofhat.com Software nginx/1.10.3 (Ubuntu) / Resource Hash `3f8e2a411c72d15c52e277ce9ded5ad2ea9ebc8491a9b0b4dfd7403fa4db81ca` Request headers Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 Referer https://spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a/login/? X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 05 Sep 2020 18:50:17 GMT Server nginx/1.10.3 (Ubuntu) Connection keep-alive Content-Length 57 Content-Type application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			spk-kundencenter-de-safe-redirect-home-portal.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: do1b18kng27l40n5872sekshm1
			spk-kundencenter-de-safe-redirect-home-portal.ru/service-portal/03d8a746892d3f3bfeb7f9405ff5cc4a	1969-12-31 23:59:59	Name: bid Value: 03d8a746892d3f3bfeb7f9405ff5cc4a

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

shrt.es
spk-kundencenter-de-safe-redirect-home-portal.ru
ug-ltd.xyz
188.94.254.137
2606:4700:3035::681c:b37
91.92.109.167
0e322d75e7e6d86475f347f96a1f770a17025eec6070a0d8735177af29094d8a
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
117bce8813acf5c9ee88220b82297dcbec9fd00f46178e6a78d0533b9252f276
353b8f56926b58e1c037ac912432156fff183d03d5f42a1f5d2ec06199e446f4
3f8e2a411c72d15c52e277ce9ded5ad2ea9ebc8491a9b0b4dfd7403fa4db81ca
47c4c7b3fddbf6b4c854f09c3d434da26826a2affeca30874e1846ce275b3bc0
4aea18f209023234a92e63a8a1f66e0c4b85a031391792e81d39f8f3901a13f0
5585d482c2eee6acbeca5fe3d9ffaad32b15c5b26995ee345b0208f557571155
69103444fe79a8e12842f03660dcdf5122a2c507422d5402a32f238f61f2fee1
723733a7bb6f25194a40769ba4b2c4b4840d707bba89f745984fab9442f72141
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7cc0a4759f5cfe7d8a6f191f79a38b1c8e36c975f160b89f21d31436dff05c4e
8038a801db146c04dfba811a22ec2971ebbdc49e9fd483cd4f48c20883b4c73a
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
92a47005456ffc3265cfb02b76cfb77edf109347cd59ef3c755aec4ffd4e8e85
a4f04574b20972a5b290984c214ff23af7810b73db0a640c75bf11b2a042336b
b87d2aaa6bb1dd568673b4cdc22bd6e1cf278710779f0e407642fed6e61cfd64
d6fff4dce0ed66b0ef96ec5165e4b5fa7d2d193df2537040630dd19606b7b664

spk-kundencenter-de-safe-redirect-home-portal.ru Open in urlscan Pro 91.92.109.167 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

1 IPs

3 Countries

324 kBTransfer

500 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

2 Cookies

Indicators

spk-kundencenter-de-safe-redirect-home-portal.ru Open in urlscan Pro
91.92.109.167 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

3
Countries

324 kB
Transfer

500 kB
Size

2
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!