vr-kundenberatung.com Open in urlscan Pro
8.212.181.178 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://heyharryworldwide.com/cantorscher.com/wp-content/plugins/jetpack/vendor/nojimage/twitter-text-php/lib/Twitter/Text/cal...
Effective URL:
https://vr-kundenberatung.com/UMF8FKVWAB
Submission: On March 22 via manual (March 22nd 2022, 2:11:52 pm UTC) from DE — Scanned from DE

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 27 HTTP transactions. The main IP is 8.212.181.178, located in Manila, Philippines and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is vr-kundenberatung.com.
TLS certificate: Issued by R3 on March 17th 2022. Valid for: 3 months.

This is the only time vr-kundenberatung.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Volksbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	199.204.248.133 199.204.248.133	11989 (WEBINT) (WEBINT)
8	8.212.181.178 8.212.181.178	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (STACKPATH...) (STACKPATH-CDN)
27	5

1 199.204.248.133 (United States)

ASN11989 (WEBINT, US)
PTR: cp22.machighway.com

heyharryworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 8.212.181.178 (Manila, Philippines)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

vr-kundenberatung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	vr-kundenberatung.com vr-kundenberatung.com	412 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 588	122 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 194	28 KB
1	heyharryworldwide.com heyharryworldwide.com	341 B
27	4

	Domain	Requested by
8	vr-kundenberatung.com	vr-kundenberatung.com
1	code.jquery.com	vr-kundenberatung.com
1	cdnjs.cloudflare.com	vr-kundenberatung.com
1	heyharryworldwide.com
27	4

This site contains no links.

Subject Issuer	Validity	Valid
vr-kundenberatung.com R3	`2022-03-17` - `2022-06-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://vr-kundenberatung.com/UMF8FKVWAB
Frame ID: 1B32C8A3F6CA3C82202111C5120FECA1
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Portal für Privatkunden - Volksbank Raiffeisenbankline-searchtopdownprevline-menuline-loginline-closelinknextE-MailRückruf

Page URL History Show full URLs

http://heyharryworldwide.com/cantorscher.com/wp-content/plugins/jetpack/vendor/nojimage/twitter-text-php/... Page URL
https://vr-kundenberatung.com/UMF8FKVWAB Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

27
Requests

37 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

562 kB
Transfer

1076 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://heyharryworldwide.com/cantorscher.com/wp-content/plugins/jetpack/vendor/nojimage/twitter-text-php/lib/Twitter/Text/calendar.php?r=bD1odHRwczovL3ZyLWt1bmRlbmJlcmF0dW5nLmNvbS9VTUY4RktWV0FC Page URL
https://vr-kundenberatung.com/UMF8FKVWAB Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK calendar.php
heyharryworldwide.com/cantorscher.com/wp-content/plugins/jetpack/vendor/nojimage/twitter-text-php/lib/Twitter/Text/ 85 B
341 B 1371ms
843ms Document
text/html 199.204.248.133
WEBINT

General

Check archive.org

Show headers Download Go to

Full URL: http://heyharryworldwide.com/cantorscher.com/wp-content/plugins/jetpack/vendor/nojimage/twitter-text-php/lib/Twitter/Text/calendar.php?r=bD1odHRwczovL3ZyLWt1bmRlbmJlcmF0dW5nLmNvbS9VTUY4RktWV0FC
Protocol: HTTP/1.1
Server: 199.204.248.133 , United States, ASN11989 (WEBINT, US),
Reverse DNS: cp22.machighway.com
Software: Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Tue, 22 Mar 2022 14:12:14 GMT
Server: Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request UMF8FKVWAB Show response
vr-kundenberatung.com/ 94 KB
24 KB 2535ms
1019ms Document
text/html 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: e4ad92960a2fdc7aa428b592bf08a2f4eb9f6ac359d19cd8eb09569eab103431

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://heyharryworldwide.com/

Response headers

Server: nginx
Date: Tue, 22 Mar 2022 14:11:49 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip

GET
H/1.1 200
OK layout.css
vr-kundenberatung.com/apps/settings/wcm/designs/webcenter/page_z/20_1_2/layout/css-source/ 330 KB
330 KB 587ms
587ms Stylesheet
text/css 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://vr-kundenberatung.com/apps/settings/wcm/designs/webcenter/page_z/20_1_2/layout/css-source/layout.css
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: d9d36347f3d29c1b55cc381c77af923de68be504117d55329ef4d247a4a9ff14

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:50 GMT
Last-Modified: Mon, 19 Apr 2021 21:07:35 GMT
Server: nginx
ETag: "607df117-528f5"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 338165

GET
H/1.1 200
OK logo-vr.svg
vr-kundenberatung.com/ 11 KB
11 KB 969ms
969ms Image
image/svg+xml 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-kundenberatung.com/logo-vr.svg
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: a98221c9155dc607127fe88bbcbc7d88296b084a56661ff27f627e7913dc5c8f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:50 GMT
Last-Modified: Mon, 19 Apr 2021 14:57:15 GMT
Server: nginx
ETag: "607d9a4b-2cc5"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11461

GET
H/1.1 200
OK corona-verteilerseite-vrnw-kampagne-schmal-nur-webbank.jpg
vr-kundenberatung.com/content/ 43 KB
43 KB 1886ms
917ms Image
image/jpeg 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-kundenberatung.com/content/corona-verteilerseite-vrnw-kampagne-schmal-nur-webbank.jpg
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 6493f9583b0a7d16dc68a0cb303e7406ed80fd540283135f215c3f17f1a2d38f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:51 GMT
Last-Modified: Sat, 17 Apr 2021 11:05:31 GMT
Server: nginx
ETag: "607ac0fb-ac69"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 44137

GET
H/1.1 200
OK card-lock.png
vr-kundenberatung.com/content/ 316 B
547 B 1779ms
611ms Image
image/png 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-kundenberatung.com/content/card-lock.png
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: fef43548a240a831c7be9bd0114fcb3f3e45dfdf4f3d723a8cdaa94028edf64b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:51 GMT
Last-Modified: Sat, 17 Apr 2021 12:25:08 GMT
Server: nginx
ETag: "607ad3a4-13c"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 316

GET
H/1.1 200
OK security.png
vr-kundenberatung.com/content/ 454 B
685 B 1792ms
617ms Image
image/png 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-kundenberatung.com/content/security.png
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: b4e4d75e2a154aecbebb502d3a7ce19798922e864c777c3b93f72cb56d724698

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:51 GMT
Last-Modified: Sat, 17 Apr 2021 12:24:44 GMT
Server: nginx
ETag: "607ad38c-1c6"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 454

GET
H/1.1 200
OK karriere.png
vr-kundenberatung.com/content/ 432 B
663 B 1869ms
617ms Image
image/png 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-kundenberatung.com/content/karriere.png
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: e7c484e66741a570ce1b1c468dcdffa022c593621b3f06fc64f30b1c0f729172

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:51 GMT
Last-Modified: Sat, 17 Apr 2021 12:24:57 GMT
Server: nginx
ETag: "607ad399-1b0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 432

GET
H/1.1 200
OK magazin.png
vr-kundenberatung.com/content/ 364 B
595 B 924ms
629ms Image
image/png 8.212.181.178
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vr-kundenberatung.com/content/magazin.png
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.212.181.178 Manila, Philippines, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 13e65870ced69a64ea10ab710dcf909e3a7edb8ba36077070e9d77ae5ae9e085

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/UMF8FKVWAB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Mar 2022 14:11:51 GMT
Last-Modified: Sat, 17 Apr 2021 12:24:50 GMT
Server: nginx
ETag: "607ad392-16c"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 364

GET bankingapp.png
vr-kundenberatung.com/content/ 0
0

GET servicecenter.png
vr-kundenberatung.com/content/ 0
0

GET facebook-RefreshDesign.png
vr-kundenberatung.com/content/ 0
0

GET wikipedia-RefreshDesign.png
vr-kundenberatung.com/content/ 0
0

GET gute-banken-RefreshDesign.png
vr-kundenberatung.com/content/ 0
0

GET whatsapp-RefreshDesign.png
vr-kundenberatung.com/content/ 0
0

GET instagram-RefreshDesign.png
vr-kundenberatung.com/content/ 0
0

GET SchwaebischHall.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET UnionInvestment.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET RundV.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET easyCredit.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET DZBANK_Initiativbank.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET DZPrivatbank.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET VR_Smart_Finanz.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET DGHYP.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET M%c3%bcnchenerHyp.png
vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/ 0
0

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ 87 KB
28 KB 63ms
25ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 14:11:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2228077
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27958
timing-allow-origin: *
last-modified: Mon, 04 May 2020 23:01:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb09ed3-15d84"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7AQbcLcpS1%2BFnckVScnzv2gRLNyxnX6kFyM4pW8blxaezMbmu49rYdpAxi3m7R4Y%2F1pprK8n7acppvEiZvAH3khlRCHQwzeqwOMbK8k94K%2FjYhK%2FR4QicRIBgX5VfHv5vqfOfbHdmPxzfI8rHeRPjgn8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6eff84cd2daf92c9-FRA
expires: Sun, 12 Mar 2023 14:11:49 GMT

GET
H2 200 jquery-ui.js Show response
code.jquery.com/ui/1.12.1/ 509 KB
122 KB 58ms
21ms Script
application/javascript 2001:4de0:ac18::1:a:2b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.12.1/jquery-ui.js
Requested by: Host: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/UMF8FKVWAB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f455eb2ddf2094ee969f470f6bfac7adb4c057e8990a374e9da819e943c777d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://vr-kundenberatung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 14:11:49 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:54 GMT
server: nginx
etag: W/"611feaca-7f20a"
vary: Accept-Encoding
x-hw: 1647958309.dop165.fr8.t,1647958309.cds250.fr8.hn,1647958309.cds269.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 124434

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/bankingapp.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/servicecenter.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/facebook-RefreshDesign.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/wikipedia-RefreshDesign.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/gute-banken-RefreshDesign.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/whatsapp-RefreshDesign.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/instagram-RefreshDesign.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/SchwaebischHall.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/UnionInvestment.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/RundV.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/easyCredit.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/DZBANK_Initiativbank.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/DZPrivatbank.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/VR_Smart_Finanz.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/DGHYP.png

Domain: vr-kundenberatung.com
URL: https://vr-kundenberatung.com/content/dam/allgemeines/logoleisterefreshdesign/M%c3%bcnchenerHyp.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Volksbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			vr-kundenberatung.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: jg1an9n2jr4kud08qd6v9kff4g

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
heyharryworldwide.com
vr-kundenberatung.com
vr-kundenberatung.com
199.204.248.133
2001:4de0:ac18::1:a:2b
2606:4700::6810:125e
8.212.181.178
13e65870ced69a64ea10ab710dcf909e3a7edb8ba36077070e9d77ae5ae9e085
4f455eb2ddf2094ee969f470f6bfac7adb4c057e8990a374e9da819e943c777d
6493f9583b0a7d16dc68a0cb303e7406ed80fd540283135f215c3f17f1a2d38f
a98221c9155dc607127fe88bbcbc7d88296b084a56661ff27f627e7913dc5c8f
b4e4d75e2a154aecbebb502d3a7ce19798922e864c777c3b93f72cb56d724698
d9d36347f3d29c1b55cc381c77af923de68be504117d55329ef4d247a4a9ff14
e4ad92960a2fdc7aa428b592bf08a2f4eb9f6ac359d19cd8eb09569eab103431
e7c484e66741a570ce1b1c468dcdffa022c593621b3f06fc64f30b1c0f729172
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fef43548a240a831c7be9bd0114fcb3f3e45dfdf4f3d723a8cdaa94028edf64b

vr-kundenberatung.com Open in urlscan Pro 8.212.181.178 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

27 Requests

37 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

562 kBTransfer

1076 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

vr-kundenberatung.com Open in urlscan Pro
8.212.181.178 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

37 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

562 kB
Transfer

1076 kB
Size

1
Cookies

27 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!