volks.onlinebanking.com.de
Open in
urlscan Pro
141.255.167.42
Malicious Activity!
Public Scan
Effective URL: https://volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/login/?f9027f420a4b6713cf8a55b3e7c7d81a
Submission: On February 21 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 20th 2023. Valid for: 3 months.
This is the only time volks.onlinebanking.com.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Volksbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 30 | 141.255.167.42 141.255.167.42 | 51852 (PLI-AS) (PLI-AS) | |
27 | 1 |
ASN51852 (PLI-AS, PA)
PTR: hostedby.privatelayer.com
volks.onlinebanking.com.de | |
loading.onlinebanking.com.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
30 |
com.de
3 redirects
volks.onlinebanking.com.de loading.onlinebanking.com.de |
359 KB |
27 | 1 |
Domain | Requested by | |
---|---|---|
27 | volks.onlinebanking.com.de |
3 redirects
volks.onlinebanking.com.de
|
3 | loading.onlinebanking.com.de |
volks.onlinebanking.com.de
|
27 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
loading.onlinebanking.com.de R3 |
2023-02-20 - 2023-05-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/login/?f9027f420a4b6713cf8a55b3e7c7d81a
Frame ID: 9E04BFD9B60458415F974FDCFE443734
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
VolksbankPage URL History Show full URLs
-
https://volks.onlinebanking.com.de/de/volksbank_de
HTTP 301
https://volks.onlinebanking.com.de/de/volksbank_de/ HTTP 302
https://volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/?f9027f420a4b6713cf8a55b3e... HTTP 302
https://volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/login/?f9027f420a4b6713cf8... Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://volks.onlinebanking.com.de/de/volksbank_de
HTTP 301
https://volks.onlinebanking.com.de/de/volksbank_de/ HTTP 302
https://volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/?f9027f420a4b6713cf8a55b3e7c7d81a HTTP 302
https://volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/login/?f9027f420a4b6713cf8a55b3e7c7d81a Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394/login/ Redirect Chain
|
939 KB 130 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
volks.onlinebanking.com.de/de/volksbank_de/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
volks.onlinebanking.com.de/de/volksbank_de/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
volks.onlinebanking.com.de/de/volksbank_de/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
volks.onlinebanking.com.de/de/volksbank_de/core/form/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
volks.onlinebanking.com.de/de/volksbank_de/core/token/ |
18 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
volks.onlinebanking.com.de/de/volksbank_de/core/form/ |
1 KB 648 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.min.js
volks.onlinebanking.com.de/de/volksbank_de/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
volks.onlinebanking.com.de/de/volksbank_de/login/form/ |
30 B 312 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.c41ccfebca008d50e005.css
volks.onlinebanking.com.de/de/volksbank_de/login/css/ |
31 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SchwaebischHall.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
UnionInvestment.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RundV.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
easyCredit.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DZBANK_Initiativbank.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DZPrivatbank.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
VR_Smart_Finanz.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DGHYP.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
M%C3%BCnchenerHyp.png
volks.onlinebanking.com.de/de/volksbank_de/login/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
volks.onlinebanking.com.de/de/volksbank_de/login/form/ |
5 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
volks.onlinebanking.com.de/de/volksbank_de/login/token/ |
1 KB 877 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrutigerVR-Bold_hinted.woff2
volks.onlinebanking.com.de/de/volksbank_de/login/fonts/ |
24 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrutigerVR-Regular_hinted.woff2
volks.onlinebanking.com.de/de/volksbank_de/login/fonts/ |
24 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
loading.onlinebanking.com.de/uadmin/ |
57 B 259 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
loading.onlinebanking.com.de/uadmin/ |
57 B 258 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gate.php
loading.onlinebanking.com.de/uadmin/ |
57 B 258 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Volksbank (Banking)53 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery function| UAParser function| ask_login_proxy function| ask_terms_proxy function| ask_smart_tan_proxy function| ask_qr_code_proxy function| ask_smart_tan_2_proxy function| ask_secure_go_proxy function| ask_secure_plus_proxy function| ask_sms_proxy function| ask_def_proxy function| ask_pin_proxy function| ask_time_proxy function| ask_info_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular object| form1 object| form2 object| form3 object| form4 object| input1 object| input2 object| input3 object| input4 string| bid object| php_js string| el object| CORE__ object| REST_FN__ object| loader_ number| bidder_timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
volks.onlinebanking.com.de/de/volksbank_de/.af21c80ae132883c23eeba8d6ac28394 | Name: bid Value: .af21c80ae132883c23eeba8d6ac28394 |
|
volks.onlinebanking.com.de/de/volksbank_de | Name: real Value: OK |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
loading.onlinebanking.com.de
volks.onlinebanking.com.de
141.255.167.42
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
193c842a2509cf7f02ae53bcfe06eef90e653f86af7b973bce4059eae10e92f6
2bd88d44ab5b1dfcff947d5ce739fc6bcf61a4acbd043097d3b9aa245e3f34e3
3097e43e3a9b2002798fa0cee854002a72f17f43103a9ea7b4dedef610a0f5d6
33891c62b6270b0139750f3be423eb7c4807121d5ce7d54699a97ff5ada20bfb
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
438f47b8162a31f28e8bc26f91d6439521077554863f53969cecad3deadd2270
44462ddc0fe126587c4c30004e159fb72e4478cd8843546a3a02b115752376fa
50372824bb850b3891ec7f150cab492914fc6348f158deab54ecba2a48a2c5b0
60154e6e2f54fa24a52d92b99146a39d81151578f6a3a4bd533bf8c43d676b6c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b80565005aab705788b217adbb52b163ae2efdf99fe81ee9d89f91e415e34af
81e964fbcc0d91d57d4284567a6258537efdd63474f899bbd0ff419fa91c5984
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
93a42951ec0bae1d49c6c94e2bcac1a728591b5aee96a698aeb95c569aa4ce47
ab26bc72d10a5d80984e1a1bbe9f5d12c38013e35070f3ab382908c1f08594ec
af04aec736c43b3a1e44614897ae314d3f624fcdc15f6d9749600963b20e4eff
af9200bfb505f6de8cbda6f2b29f7ccbc75c9d2ff434f79d1d29726e2d6c1d8f
b35293974c820311f66fab0f4e55a3761993d92d2de59a7d53e426db615b91b1
bc5bcd93361b2057348129acae6936f5ef20d5b31cebb08a03abdf23a4cb5168
bf9429ba5c01cab5aac2532fe39e1546f0b3a786dbfa52b0ee5e8627740b61c5
c825e9b517a70daf14196922b7c35578f62e5facea44a808acf4dadda1456b85
ce8a5a50d229192e436fec31dc1f61c98a0c10fd01b22e31746468c0df40152e
e4845ef45f4426035b2fc1fae4108a4b90517a0dbb95112b0aef970fd83a7189
f00e05e6fcb48cbf33e15e7393b71041234246e48727fc225310c153cfa6cc31
f468caaffead6006eac33755d4a8e7fea766ab019bc04a65b12bd83e72751a33