great-kalam.52-54-98-35.plesk.page
Open in
urlscan Pro
52.54.98.35
Malicious Activity!
Public Scan
Effective URL: https://great-kalam.52-54-98-35.plesk.page/de/clianta.php?dispatch=fcc09cf0f7f9502e978ac2134eaac663
Submission: On February 10 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 9th 2023. Valid for: 3 months.
This is the only time great-kalam.52-54-98-35.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Landesbank Berlin (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 190.61.4.74 190.61.4.74 | 18747 (IFX18747) (IFX18747) | |
2 14 | 52.54.98.35 52.54.98.35 | 14618 (AMAZON-AES) (AMAZON-AES) | |
13 | 2 |
ASN18747 (IFX18747, US)
PTR: hosting-plesk-linux.ifxnetworks.com
jolly-ride.190-61-4-74.plesk.page |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-98-35.compute-1.amazonaws.com
great-kalam.52-54-98-35.plesk.page |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
plesk.page
2 redirects
jolly-ride.190-61-4-74.plesk.page great-kalam.52-54-98-35.plesk.page |
774 KB |
13 | 1 |
Domain | Requested by | |
---|---|---|
14 | great-kalam.52-54-98-35.plesk.page |
2 redirects
great-kalam.52-54-98-35.plesk.page
|
1 | jolly-ride.190-61-4-74.plesk.page | |
13 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
apps.apple.com |
play.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
jolly-ride.190-61-4-74.plesk.page R3 |
2023-02-09 - 2023-05-10 |
3 months | crt.sh |
great-kalam.52-54-98-35.plesk.page R3 |
2023-02-09 - 2023-05-10 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://great-kalam.52-54-98-35.plesk.page/de/clianta.php?dispatch=fcc09cf0f7f9502e978ac2134eaac663
Frame ID: 2BCCFE5B9A889B53577E0F987BFEE875
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
AnmeldenPage URL History Show full URLs
- https://jolly-ride.190-61-4-74.plesk.page/ Page URL
-
https://great-kalam.52-54-98-35.plesk.page/de
HTTP 301
https://great-kalam.52-54-98-35.plesk.page/de/ HTTP 302
https://great-kalam.52-54-98-35.plesk.page/de/clianta.php?dispatch=fcc09cf0f7f9502e978ac2134eaac663 Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://jolly-ride.190-61-4-74.plesk.page/ Page URL
-
https://great-kalam.52-54-98-35.plesk.page/de
HTTP 301
https://great-kalam.52-54-98-35.plesk.page/de/ HTTP 302
https://great-kalam.52-54-98-35.plesk.page/de/clianta.php?dispatch=fcc09cf0f7f9502e978ac2134eaac663 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
jolly-ride.190-61-4-74.plesk.page/ |
194 B 237 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
clianta.php
great-kalam.52-54-98-35.plesk.page/de/ Redirect Chain
|
118 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
great-kalam.52-54-98-35.plesk.page/de/assets/css/ |
2 KB 427 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
great-kalam.52-54-98-35.plesk.page/de/assets/css/ |
292 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
solvemate-client-bundle.css
great-kalam.52-54-98-35.plesk.page/de/assets/css/ |
3 KB 967 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
great-kalam.52-54-98-35.plesk.page/de/assets/imgs/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-brand-large.svg
great-kalam.52-54-98-35.plesk.page/de/assets/imgs/ |
4 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-image-cards.png
great-kalam.52-54-98-35.plesk.page/de/assets/imgs/ |
382 KB 383 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-store.svg
great-kalam.52-54-98-35.plesk.page/de/assets/imgs/ |
16 KB 17 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play.svg
great-kalam.52-54-98-35.plesk.page/de/assets/imgs/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AmazonEmber_He.ttf
great-kalam.52-54-98-35.plesk.page/de/assets/fonts/ |
98 KB 98 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AmazonEmber_Bd.ttf
great-kalam.52-54-98-35.plesk.page/de/assets/fonts/ |
101 KB 102 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AmazonEmber_Rg.ttf
great-kalam.52-54-98-35.plesk.page/de/assets/fonts/ |
104 KB 104 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Landesbank Berlin (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
great-kalam.52-54-98-35.plesk.page
jolly-ride.190-61-4-74.plesk.page
190.61.4.74
52.54.98.35
0129dcd791318524381b6e803d6f6ada26e9f26f9c94f9cf4c5c86263204335b
152c9c40b476d3be5b6ba76063d08be272a4ffd16fb93aacba41414a7a42377f
2e4f91e4755702a1ec8a9dd70f45be9913562f9332d8d35514581c21fa1abb8f
3adb19d6a350dd06b87822448641b7f1caf0b20832e30f0322b93f6035dc7c26
53221bb15cc0dab8786c0f19f4ef1cf64b8847a06e0e37ca93f11f3eb95dcd99
5b86a47f36d9785abd6bc48f975ea4372d421dba2526b886f4b3663e2982c281
72c249d1b7a81e28d8f4e91d4a5e8de1b60472d50a0497e147bc01c0b01f3c4b
8d001762907d743767f1af5c3398fd97d1be7aed3cb7c819a500156c49524484
a94aaf53d42548969faf5dacf2d8fb3e89cc53fcc0c2207b478fd0dc5f8c4b5a
aa3aa58e65d185f8969ecc344e8ba9439e06956ecb88d214e6e92b4966831d49
c5b42fab03ceb850ba5cc7def2871d268ad7c02b454941eeccc92d8f1e7cc760
ca516daaa4549ca61ea1d018a03ca9ba2723ef71162bf32da332a85938cd235c
dfc011af1c4e2c15a2c59856e6f516c504ed10d58238f6835e1159aa8d37b608