www.sparda-m.de
Open in
urlscan Pro
213.95.18.102
Malicious Activity!
Public Scan
Effective URL: https://www.sparda-m.de/FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4
Submission: On January 25 via api from US
Summary
TLS certificate: Issued by QuoVadis EV SSL ICA G3 on July 11th 2019. Valid for: a year.
This is the only time www.sparda-m.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Volksbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 15 | 213.95.18.102 213.95.18.102 | 12337 (NORIS-NET...) (NORIS-NETWORK IT Service Provider located in Nuernberg) | |
4 | 152.199.23.241 152.199.23.241 | 15133 (EDGECAST) (EDGECAST) | |
2 | 2a00:1450:400... 2a00:1450:4001:814::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 185.54.150.94 185.54.150.94 | 60164 (WEBTREKK-AS) (WEBTREKK-AS) | |
21 | 5 |
ASN12337 (NORIS-NETWORK IT Service Provider located in Nuernberg, Germany, DE)
PTR: www.sparda-m.de
www.sparda-m.de |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
sparda-m.de
1 redirects
www.sparda-m.de |
910 KB |
4 |
tiqcdn.com
tags.tiqcdn.com |
35 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
1 |
sparda.de
proditor.sparda.de |
638 B |
21 | 4 |
Domain | Requested by | |
---|---|---|
15 | www.sparda-m.de |
1 redirects
www.sparda-m.de
|
4 | tags.tiqcdn.com |
www.sparda-m.de
tags.tiqcdn.com |
2 | www.google-analytics.com |
tags.tiqcdn.com
|
1 | proditor.sparda.de | |
21 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
banking.sparda-m.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.sparda-m.de QuoVadis EV SSL ICA G3 |
2019-07-11 - 2020-07-11 |
a year | crt.sh |
*.tiqcdn.com DigiCert SHA2 Secure Server CA |
2017-10-25 - 2020-05-13 |
3 years | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-01-07 - 2020-03-31 |
3 months | crt.sh |
proditor.sparda.de QuoVadis Global SSL ICA G3 |
2019-12-04 - 2021-12-04 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.sparda-m.de/FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4
Frame ID: A24FA079A222C8BF284CA1A4E0241249
Requests: 22 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.sparda-m.de/FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4
HTTP 301
https://www.sparda-m.de/FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4 Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Tealium (Advertising Networks) Expand
Detected patterns
- script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Online-Banking Login
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.sparda-m.de/FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4
HTTP 301
https://www.sparda-m.de/FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
FVajH6CFHhmYMuQ!uhqu_SkRZqMBzCXqO7JkgYLs3kAAIjPOXUYR_qZGnUyDZqoUCXiLU4
www.sparda-m.de/ Redirect Chain
|
95 KB 96 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeueLT-RomanWOFF2.woff2
www.sparda-m.de/resources/styleguide/latest/fonts/ |
26 KB 27 KB |
Font
application/x-font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpardaIconFontWOFF2.woff2
www.sparda-m.de/resources/styleguide/latest/fonts/ |
24 KB 25 KB |
Font
application/x-font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.min.css
www.sparda-m.de/resources/styleguide/latest/css/ |
341 KB 57 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
print.min.css
www.sparda-m.de/resources/styleguide/latest/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-sparda-bank.svg
www.sparda-m.de/admin/bank-logos/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error-404-segelschiff.png
www.sparda-m.de/internetauftritt/fehlerseiten/ |
343 KB 343 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.min.js
www.sparda-m.de/resources/styleguide/latest/js/ |
598 KB 157 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeueLT-LightWOFF.woff
www.sparda-m.de/resources/styleguide/latest/fonts/ |
41 KB 42 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeueLT-MediumWOFF.woff
www.sparda-m.de/resources/styleguide/latest/fonts/ |
42 KB 43 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpardaIconFontWOFF2.woff2
www.sparda-m.de/resources/styleguide/latest/fonts/ |
24 KB 25 KB |
Font
application/x-font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeueLT-BoldWOFF.woff
www.sparda-m.de/resources/styleguide/latest/fonts/ |
47 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeueLT-RomanWOFF.woff
www.sparda-m.de/resources/styleguide/latest/fonts/ |
42 KB 43 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
43 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
javascript-konfigurationen.json
www.sparda-m.de/internetauftritt/globale-technische-seiten/ |
6 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.js
tags.tiqcdn.com/utag/sdv-it/web/prod/ |
27 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.4.js
tags.tiqcdn.com/utag/sdv-it/web/prod/ |
69 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.29.js
tags.tiqcdn.com/utag/sdv-it/web/prod/ |
22 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ |
2 B 124 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wt
proditor.sparda.de/483540781426833/ |
43 B 638 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ |
35 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Volksbank (Banking)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| utag_data object| sparda object| ParallaxScroll function| $ function| jQuery object| lightbox function| loadjs function| autosize string| resourceBaseUrl function| loadTealium boolean| utag_condload object| utag string| GoogleAnalyticsObject function| ga function| __tealium_webtrekkSafeTag object| webtrekkUnloadObjects object| webtrekkLinktrackObjects object| webtrekkHeatmapObjects function| WebtrekkV3 function| webtrekkV3 object| webtrekkConfig object| wt object| google_tag_data object| gaplugins object| gaGlobal object| gaData2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.sparda-m.de/ | Name: TS01bff4a1 Value: 0131dfe881b5aec6d223dcd8c652cb40e7fe41be9fa45dc534db744ff23347469f3f54cb2820af45e0cb0c09f7478e3755f5bde469 |
|
www.sparda-m.de/ | Name: iServer Value: !mN+HDb31cVoRE8gpqNQzDXkDaxQEBWE/fY5lTmI4G0MMQJDVh37xPpMj18b5k1BiXr83MlOgsuZfnj8= |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
proditor.sparda.de
tags.tiqcdn.com
www.google-analytics.com
www.sparda-m.de
152.199.23.241
185.54.150.94
213.95.18.102
2a00:1450:4001:814::200e
0164c412337fbf65bbc4088ede528b159e87392ab6756586dc153070e190a4c1
096524cf9ee867f5fc8159b64496398fa962948fcd8f0f8144571cf135676a6f
13da8ead1c2ad9a95475348282ef5000d9c8ba844f2a412fdda7064fdd9b976d
2890e1cd0f24615e6d86e690dbeb7f135f037689c3132f0ea1d1db8d0930b228
2b21fe86d36274343d155c39515259a3614109109b9e0fce36cdfe0902add355
34522a4e71af8ad7ff0ca5bbd9c30b72d96eae6d500eaec3ce1acada20e9d6ba
4f083ac3cc35b8f5abaa57ab1ad8f5bf6dacd2480007ecd49a1b620fba0efe36
52b14da0d9c32a527fa6fc7ed5f928cb9e7affd289a21a94b87b528edc8660c3
54e247aaa9ec75d15a6610dfa60f974e0a32277cb9d27c594550a17946776a36
77ab695d18d6b1ff77e8d619dbccda0e8dc7a457a1417e289e86dfe166dfb57e
7a98ac87ec703475ad53eceb5f07895d7ef80ead41d51bb0caaa526931956ea5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9cf33025a8b7ef59df53cc649879d33c4ca76f90a18eca7df257163c2438201c
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a4004b4077cec7c4b45c0950a4a97f539cb0d0875418c232e5ec3d2913211577
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bf068b808cb14df842a5567cafcdf4ed30cf61b4519d70a88372cc2b28ec0f00
c4ca2b36f7cf8ff1840447af54da57abd02d7465751aca7ebc32c5e9b0f65ce4
dac72e466c9277b0a6da960ac9036dcbec9c89fff2d8fb2cc42e63b48fd815bd
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a