stadtsparkasse-mail-service2.xyz Open in urlscan Pro
2606:4700:3034::ac43:b9eb Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3fax9Wb
Effective URL:
https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj
Submission Tags: 7109853
Submission: On May 13 via api (May 13th 2021, 11:30:32 am UTC) from NL

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3034::ac43:b9eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is stadtsparkasse-mail-service2.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 9th 2021. Valid for: a year.

This is the only time stadtsparkasse-mail-service2.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
1 1	31.41.218.132 31.41.218.132	42655 (BESTHOSTI...) (BESTHOSTING-AS)
1 1	2606:4700:303... 2606:4700:3035::ac43:bb7f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 9	2606:4700:303... 2606:4700:3034::ac43:b9eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	1

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.41.218.132 (Ukraine) 1 redirects

ASN42655 (BESTHOSTING-AS, UA)

g.short-rechter.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:bb7f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

mail-service4.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:3034::ac43:b9eb (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

stadtsparkasse-mail-service2.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	stadtsparkasse-mail-service2.xyz 1 redirects stadtsparkasse-mail-service2.xyz	185 KB
1	mail-service4.xyz 1 redirects mail-service4.xyz	600 B
1	short-rechter.xyz 1 redirects g.short-rechter.xyz	258 B
1	bit.ly 1 redirects bit.ly	258 B
8	4

	Domain	Requested by
9	stadtsparkasse-mail-service2.xyz	1 redirects stadtsparkasse-mail-service2.xyz
1	mail-service4.xyz	1 redirects
1	g.short-rechter.xyz	1 redirects
1	bit.ly	1 redirects
8	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-05-09` - `2022-05-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj
Frame ID: EA246DB3EB1E6585C8D6F9E6BE1C1EFA
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/3fax9Wb HTTP 301
http://g.short-rechter.xyz/LYxQCLgE HTTP 302
https://mail-service4.xyz/sperma2 HTTP 307
https://stadtsparkasse-mail-service2.xyz/s/?s=x4u7tpkv47b8g0yyhfmnooaviu1zlhmk HTTP 302
https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnW... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

1
IPs

2
Countries

184 kB
Transfer

400 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3fax9Wb HTTP 301
http://g.short-rechter.xyz/LYxQCLgE HTTP 302
https://mail-service4.xyz/sperma2 HTTP 307
https://stadtsparkasse-mail-service2.xyz/s/?s=x4u7tpkv47b8g0yyhfmnooaviu1zlhmk HTTP 302
https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3-29	200	Primary Request anmeldung.php Show response stadtsparkasse-mail-service2.xyz/s/ Redirect Chain https://bit.ly/3fax9Wb http://g.short-rechter.xyz/LYxQCLgE https://mail-service4.xyz/sperma2 https://stadtsparkasse-mail-service2.xyz/s/?s=x4u7tpkv47b8g0yyhfmnooaviu1zlhmk https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj	11 KB 3 KB	261ms 242ms	Document text/html	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `820e9c07a357413578465c3d240848b1574800f2addf6ee4161ecc11e2baddee` Request headers :method GET :authority stadtsparkasse-mail-service2.xyz :scheme https :path /s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT content-type text/html; charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 0a0716eace00002c4ece3b1000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yCZZew4e7%2BV2PD6opencQZSSNMcBr%2FjAFUxLi%2BsjRNN0%2F8BPqrCXlfdgj7oYSQ2pJnm2kYog%2F8WwyTUGqSMXsRJfDt%2BuRKTj2f0XUHQbKtjEDE1dWH6ZO8BVTVirU%2F%2BkqA0rZgQMiWebkqKNeA%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 64eb8dbe1e762c4e-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Redirect headers date Thu, 13 May 2021 11:30:15 GMT content-type text/html; charset=UTF-8 set-cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache location anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj cf-cache-status DYNAMIC cf-request-id 0a0716e9e300004e26fe816000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oSUT%2FtNM10FRbxwG9tH5I%2FztyCF0YHb9usTIh6DvdottqH9RjTmKQWlW%2FNrnt5RINU2Vum53qzuGpJMt5FaWT%2BQPoGEbk%2F%2B8EBnR0Juqa52vMUxwcxPQBzmAR5RbOqkUyqkvFPkz0Twb2yOHsg%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 64eb8dbc999e4e26-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3-29	200	ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css stadtsparkasse-mail-service2.xyz/s/src/css/	249 KB 39 KB	27ms 26ms	Stylesheet text/css	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b8b51ca2d76d70709c6c9aa47b504dc4484cf89b508df064dc9c2b53d6ee75c4` Request headers :path /s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css pragma no-cache cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj :scheme https sec-fetch-site same-origin :method GET Referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1927 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0a0716ebc800002c4eed038000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag W/"3e436-5c15df5b0fed0-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lhY28iF0xEAtALzCG1wHNQ%2B3fKbYK%2BzIuXUdDDIW3CK8XAV44dyNp9y18Gi%2BGI1oFmt%2FpWQKujEzSQgvLY5JaC5Lb0QjqxcC2kLnXiAJTcYvhc5q9uCBH6Urldm2M9J%2FcnOm4EoxkVfku9nGTA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 64eb8dbfaa092c4e-FRA
GET H3-29	200	ZR1pMwPB9Xsl53CW8qSL.png stadtsparkasse-mail-service2.xyz/s/src/img/	2 KB 2 KB	18ms 17ms	Image image/png	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://stadtsparkasse-mail-service2.xyz/s/src/img/ZR1pMwPB9Xsl53CW8qSL.png Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b9e830e96a27b155e68fbf2bd76b10c2e9e054874c9c3c1e97bbaea573259894` Request headers :path /s/src/img/ZR1pMwPB9Xsl53CW8qSL.png pragma no-cache cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj :scheme https sec-fetch-site same-origin :method GET Referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1927 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1902 cf-request-id 0a0716ebc900002c4e8d0da000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag "76e-5c15df5b106a0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YGqDnBGnsc7QFCFoRCe9Dps7IJmXmRwNetINnwbcjPOUkGgQTkSSoBIi777mUOxqbNzjuUAKtUoat%2FIJ8kaOsuT0KEUKZNPJinurVN1wbuTMdcZLFAhpojoYKhVZOX6UTHrjce07n%2Fe7%2BtyVkQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 64eb8dbfaa102c4e-FRA
GET H3-29	200	WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png stadtsparkasse-mail-service2.xyz/s/src/img/	3 KB 3 KB	23ms 22ms	Image image/png	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://stadtsparkasse-mail-service2.xyz/s/src/img/WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9ef3568cb4cbc5b4a96dba63ccff15a441eac6d17c91fa963d2ac1b4534520d6` Request headers :path /s/src/img/WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png pragma no-cache cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj :scheme https sec-fetch-site same-origin :method GET Referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1927 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 2729 cf-request-id 0a0716ebc900002c4e908c8000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag "aa9-5c15df5b106a0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BW%2F%2BaRx4zJnvRRMtR0qzvrVQAdwqjMEcftwYSVIRXQUU6j816p6rhALWsjSFHXsCjClbg3ozxSdTv6%2FvDE1feP5Vab02bVSrNl1hjITxfZol6ndqMwHW9V%2FT4iyMoPODvuD5FxHwxnFF4U90uw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 64eb8dbfaa112c4e-FRA
GET H3-29	200	spk-logo-druck.png stadtsparkasse-mail-service2.xyz/s/src/img/	10 KB 10 KB	17ms 16ms	Image image/png	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://stadtsparkasse-mail-service2.xyz/s/src/img/spk-logo-druck.png Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d16cd665d719c20820702b390ce43791ec4ae374d5233251b04d578264808684` Request headers :path /s/src/img/spk-logo-druck.png pragma no-cache cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj :scheme https sec-fetch-site same-origin :method GET Referer https://stadtsparkasse-mail-service2.xyz/s/anmeldung.php?starten=Ck19Rp6TlHwS4IWAgB05LZXhdcr2ya&shufflUri?=yklxB3usnWtiDoR2QNTj User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1927 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 10048 cf-request-id 0a0716ebca00002c4ec034d000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag "2740-5c15df5b106a0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=a%2BZYzXFKwfRK%2Fa5yAdZ847Q4qt5hKEAzaRK6HBXCiXoCXc31rTG5Dy3qW%2BGyySMjbrUsvmOOc8r%2FT9tmV3DJKjYYPj6XS50z3KV0HGwcSLIiCGqgPs4EqEkJbQC53%2BTHjqyzovYgJxs32Zq5PA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 64eb8dbfaa142c4e-FRA
GET H3-29	200	GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff stadtsparkasse-mail-service2.xyz/s/src/fonts/	39 KB 39 KB	13ms 12ms	Font application/font-woff	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stadtsparkasse-mail-service2.xyz/s/src/fonts/GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2` Request headers sec-fetch-mode cors origin https://stadtsparkasse-mail-service2.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg :path /s/src/fonts/GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept / cache-control no-cache :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css :scheme https sec-fetch-site same-origin :method GET Origin https://stadtsparkasse-mail-service2.xyz Referer https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1774 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0a0716ebf800002c4eed03d000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag W/"9a44-5c15df5b0fed0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LGwqnYHSezgIB0FTohf%2FbBfxG44pniVeFCEOoC32ev5K6sU%2Bbn2PUjC9pHRU%2FrIHoPl8%2BOH7VtEVUt04hJN%2Fs%2BuxqK7%2BZUykpF8j5eyEOZvRoG4u3%2BO9%2FU6lqNZpOiH4MlE5KWMbeHlXgCNr1g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 64eb8dbffab02c4e-FRA
GET H3-29	200	AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff stadtsparkasse-mail-service2.xyz/s/src/fonts/	39 KB 39 KB	17ms 17ms	Font application/font-woff	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stadtsparkasse-mail-service2.xyz/s/src/fonts/AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638` Request headers sec-fetch-mode cors origin https://stadtsparkasse-mail-service2.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg :path /s/src/fonts/AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept / cache-control no-cache :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css :scheme https sec-fetch-site same-origin :method GET Origin https://stadtsparkasse-mail-service2.xyz Referer https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1774 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0a0716ebf800002c4e9f940000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag W/"9b38-5c15df5b0fed0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YHz07GAjZdYpTTB7FJ0gitrrYg6RxArE6arZ7uiO9mQlenMhUo6EiRXQ39OKskPtNRE6OL11eqHQnrkxfNY5EbbUv2nMEvhwAaTwsKT8lXIbkRTK%2F6RujPEUYTuo67bFc61aAoElzsj94%2F0rNQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 64eb8dbffab42c4e-FRA
GET H3-29	200	pictos-if.woff stadtsparkasse-mail-service2.xyz/s/src/fonts/	48 KB 48 KB	19ms 19ms	Font application/font-woff	2606:4700:3034::ac43:b9eb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stadtsparkasse-mail-service2.xyz/s/src/fonts/pictos-if.woff Requested by Host: stadtsparkasse-mail-service2.xyz URL: https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:b9eb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03` Request headers sec-fetch-mode cors origin https://stadtsparkasse-mail-service2.xyz accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie PHPSESSID=ngnrg4ucnv7993nn3opuhrksfg :path /s/src/fonts/pictos-if.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept / cache-control no-cache :authority stadtsparkasse-mail-service2.xyz referer https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css :scheme https sec-fetch-site same-origin :method GET Origin https://stadtsparkasse-mail-service2.xyz Referer https://stadtsparkasse-mail-service2.xyz/s/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 13 May 2021 11:30:15 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1774 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0a0716ebfa00002c4ed2a5b000000001 last-modified Sun, 02 May 2021 19:36:21 GMT server cloudflare etag W/"be24-5c15df5b0fed0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0vRk9RCPFwKFWSwKG1FaTelDD2uXAmIdKQa6fXPfkARUGM3YzHrNAEJklxd896h1kuVoDbgd%2Bt3EKs4nAl6aMR3T3egqCARY2kTgh9aRRRJbPLZ8gU%2FmdH%2B2p%2BCHK1GZH1%2FO1lLH8c1cucXUng%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 64eb8dbffabd2c4e-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			stadtsparkasse-mail-service2.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: ngnrg4ucnv7993nn3opuhrksfg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
g.short-rechter.xyz
mail-service4.xyz
stadtsparkasse-mail-service2.xyz
2606:4700:3034::ac43:b9eb
2606:4700:3035::ac43:bb7f
31.41.218.132
67.199.248.10
56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03
820e9c07a357413578465c3d240848b1574800f2addf6ee4161ecc11e2baddee
9ef3568cb4cbc5b4a96dba63ccff15a441eac6d17c91fa963d2ac1b4534520d6
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
b8b51ca2d76d70709c6c9aa47b504dc4484cf89b508df064dc9c2b53d6ee75c4
b9e830e96a27b155e68fbf2bd76b10c2e9e054874c9c3c1e97bbaea573259894
d16cd665d719c20820702b390ce43791ec4ae374d5233251b04d578264808684
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

stadtsparkasse-mail-service2.xyz Open in urlscan Pro 2606:4700:3034::ac43:b9eb Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

1 IPs

2 Countries

184 kBTransfer

400 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

stadtsparkasse-mail-service2.xyz Open in urlscan Pro
2606:4700:3034::ac43:b9eb Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

1
IPs

2
Countries

184 kB
Transfer

400 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!