sparkasse.de-ksk-submit-true-sid-64325312309.com Open in urlscan Pro
2400:cb00:2048:1::681b:8153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sparkasse.de-ksk-submit-true-sid-64325312309.com/aktualisierung/sicherheit/bank
Effective URL:
https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18Aq...
Submission: On August 20 via automatic, source phishtank (August 20th 2018, 1:24:20 am UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2400:cb00:2048:1::681b:8153, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is sparkasse.de-ksk-submit-true-sid-64325312309.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on August 14th 2018. Valid for: 6 months.

This is the only time sparkasse.de-ksk-submit-true-sid-64325312309.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 12	2400:cb00:204... 2400:cb00:2048:1::681b:8153		13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
11	1

12 2400:cb00:2048:1::681b:8153 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

sparkasse.de-ksk-submit-true-sid-64325312309.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	de-ksk-submit-true-sid-64325312309.com 1 redirects sparkasse.de-ksk-submit-true-sid-64325312309.com	294 KB
11	1

	Domain	Requested by
12	sparkasse.de-ksk-submit-true-sid-64325312309.com	1 redirects sparkasse.de-ksk-submit-true-sid-64325312309.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid
sni156191.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-08-14` - `2019-02-20`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
Frame ID: 4173B2EAFC97A6992E9AAF2C74ED27E2
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/aktualisierung/sicherheit/bank HTTP 302
https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&Hqrn... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

293 kB
Transfer

320 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/aktualisierung/sicherheit/bank HTTP 302
https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login-online-banking.html Show response
sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/
Redirect Chain

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/aktualisierung/sicherheit/bank
https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769

4 KB
2 KB

27ms
27ms

Document
text/html

2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ed4c85d0776c14d81c622f356822249300cd36323d0d9c1433fc4f12d40b310

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:method: GET
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
:scheme: https
:path: /de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 4173B2EAFC97A6992E9AAF2C74ED27E2

Response headers

status: 200
date: Mon, 20 Aug 2018 01:24:10 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubdomains
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 44d10f0bd81397bc-FRA
content-encoding: gzip

Redirect headers

status: 302
date: Mon, 20 Aug 2018 01:24:10 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; expires=Tue, 20-Aug-19 01:24:10 GMT; path=/; domain=.de-ksk-submit-true-sid-64325312309.com; HttpOnly PHPSESSID=2tl99aginaabu0gkepsm98o0hs; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
location: /de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
strict-transport-security: max-age=63072000; includeSubdomains
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 44d10f0b6fda97bc-FRA

GET
H2 200 l303f4dd604f678a078b197da1ff2c8a027a082b0
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 16 KB
4 KB 67ms
66ms Stylesheet
text/css 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0

Requested by

Host: sparkasse.de-ksk-submit-true-sid-64325312309.com
URL: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a91201bdf33b99e5352ead0e12c40322dc882a466df5f84947deff4b81afffe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l303f4dd604f678a078b197da1ff2c8a027a082b0
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
:scheme: https
:method: GET
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Aug 2018 01:24:10 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
status: 200
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubdomains
cf-ray: 44d10f0c183497bc-FRA
content-length: 4131
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 l29444493533b4cac940201ff131702e8bbc1d6d1
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 16 KB
6 KB 41ms
40ms Image
image/svg+xml 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l29444493533b4cac940201ff131702e8bbc1d6d1

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

74bcd86bc937c41e4045ef2a14f6619ffc828ceeca96e7c1946330c34abba648

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l29444493533b4cac940201ff131702e8bbc1d6d1
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
:scheme: https
:method: GET
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: image/svg+xml
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c183897bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 l20129d59bd683621100105230bb87da65d76b63c
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 84 KB
84 KB 101ms
100ms Image
image/png 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l20129d59bd683621100105230bb87da65d76b63c

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9797829fb133b5c591029045635cdb8166fbec2f2fd73d26b025d5287ea0209

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l20129d59bd683621100105230bb87da65d76b63c
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
:scheme: https
:method: GET
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: image/png
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c183a97bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 l228a30d70cb5975ec9cdd02f9e8bbdfdb1d206ef
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 39 KB
39 KB 96ms
95ms Image
image/png 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l228a30d70cb5975ec9cdd02f9e8bbdfdb1d206ef

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l228a30d70cb5975ec9cdd02f9e8bbdfdb1d206ef
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
:scheme: https
:method: GET
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: image/png
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c183c97bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 l1da8dcdbd37c39cccfd4b8a50a2cd087d823462e
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 6 KB
6 KB 75ms
74ms Image
image/jpeg 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l1da8dcdbd37c39cccfd4b8a50a2cd087d823462e

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l1da8dcdbd37c39cccfd4b8a50a2cd087d823462e
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
:scheme: https
:method: GET
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: image/jpeg
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c183e97bc-FRA
content-length: 5720
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 l7398e2ce7f5d8a1f76ff599f6311d40e9bf7731a Show response
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 5 KB
1 KB 74ms
73ms Script
text/css 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l7398e2ce7f5d8a1f76ff599f6311d40e9bf7731a

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

352675d6841ad42d3b60e757ff4a73beb92e6d711b9f9f41adea89a65b0a7f05

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l7398e2ce7f5d8a1f76ff599f6311d40e9bf7731a
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
:scheme: https
:method: GET
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/de/home/login-online-banking.html?0468=lgO94IZJq1tMdJoFVgf7OvocdU4BHOL2&HqrnWIwGbELblLVM5f=G18AqOwa5ECy&171345098769
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Aug 2018 01:24:10 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
status: 200
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000; includeSubdomains
cf-ray: 44d10f0c183597bc-FRA
content-length: 1447
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 l17aaedd7adaf4dbe79c60375c50621f43454a2f6
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 47 KB
47 KB 37ms
36ms Font
application/octet-stream 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l17aaedd7adaf4dbe79c60375c50621f43454a2f6

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ab337962df7162cbc12f80783277dbcf416959d80ec88a2c990d6f1a98c3f24

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l17aaedd7adaf4dbe79c60375c50621f43454a2f6
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
Origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c887a97bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 l291b0093d4cbc83c36878c133da9d5020ba6e41a
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 39 KB
39 KB 93ms
92ms Font
application/octet-stream 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l291b0093d4cbc83c36878c133da9d5020ba6e41a

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /l291b0093d4cbc83c36878c133da9d5020ba6e41a
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
Origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c887b97bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 lab1d6878055c2a15a99589ca734e2234bb8e15c8
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 39 KB
39 KB 39ms
39ms Font
application/octet-stream 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/lab1d6878055c2a15a99589ca734e2234bb8e15c8

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /lab1d6878055c2a15a99589ca734e2234bb8e15c8
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
Origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c887c97bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

GET
H2 200 ld9420cc4ff6aecb88e5db5e048e7bec780bbb70f
sparkasse.de-ksk-submit-true-sid-64325312309.com/ 27 KB
27 KB 45ms
44ms Font
application/octet-stream 2400:cb00:2048:1::681b:8153
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://sparkasse.de-ksk-submit-true-sid-64325312309.com/ld9420cc4ff6aecb88e5db5e048e7bec780bbb70f

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::681b:8153 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

133ad01e7b25970c5cbcce3d8ffb7f23eef311c5950d9fcf27463c49e9ae3f02

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Request headers

:path: /ld9420cc4ff6aecb88e5db5e048e7bec780bbb70f
pragma: no-cache
cookie: __cfduid=df156b5bddc2fedb1b628a8cce78dc45e1534728250; PHPSESSID=2tl99aginaabu0gkepsm98o0hs
origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: sparkasse.de-ksk-submit-true-sid-64325312309.com
referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://sparkasse.de-ksk-submit-true-sid-64325312309.com/l303f4dd604f678a078b197da1ff2c8a027a082b0
Origin: https://sparkasse.de-ksk-submit-true-sid-64325312309.com

Response headers

pragma: cache
date: Mon, 20 Aug 2018 01:24:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
cf-ray: 44d10f0c887d97bc-FRA
expires: Mon, 20 Aug 2018 02:24:10 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| l01c4c95da1a09d1298c872b7277d3c2c0b6973da function| l58c97261e4317d0f5a507a666fddb63b172530c1

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sparkasse.de-ksk-submit-true-sid-64325312309.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2tl99aginaabu0gkepsm98o0hs
			.de-ksk-submit-true-sid-64325312309.com/	1970-01-19 03:04:24	Name: __cfduid Value: df156b5bddc2fedb1b628a8cce78dc45e1534728250

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sparkasse.de-ksk-submit-true-sid-64325312309.com
2400:cb00:2048:1::681b:8153
133ad01e7b25970c5cbcce3d8ffb7f23eef311c5950d9fcf27463c49e9ae3f02
1ab337962df7162cbc12f80783277dbcf416959d80ec88a2c990d6f1a98c3f24
2ed4c85d0776c14d81c622f356822249300cd36323d0d9c1433fc4f12d40b310
352675d6841ad42d3b60e757ff4a73beb92e6d711b9f9f41adea89a65b0a7f05
4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753
74bcd86bc937c41e4045ef2a14f6619ffc828ceeca96e7c1946330c34abba648
a91201bdf33b99e5352ead0e12c40322dc882a466df5f84947deff4b81afffe2
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
b9797829fb133b5c591029045635cdb8166fbec2f2fd73d26b025d5287ea0209
d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

sparkasse.de-ksk-submit-true-sid-64325312309.com Open in urlscan Pro 2400:cb00:2048:1::681b:8153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

293 kBTransfer

320 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

sparkasse.de-ksk-submit-true-sid-64325312309.com Open in urlscan Pro
2400:cb00:2048:1::681b:8153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

293 kB
Transfer

320 kB
Size

2
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!