idp-a.alfa.s-mxs.net Open in urlscan Pro
213.150.12.249 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://fat.remote-support.sparkasse.at/
Effective URL:
https://idp-a.alfa.s-mxs.net/kerberoslogin/authorize?response_type=token&client_id=B01255E3&redirect_uri=https%3A%2F%2Fauth.s...
Submission Tags: @phish_report
Submission: On April 16 via api (April 16th 2024, 12:35:03 pm UTC) from FI — Scanned from AT

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 23 HTTP transactions. The main IP is 213.150.12.249, located in Austria and belongs to IT-AUSTRIA Vienna, Austria, AT. The main domain is idp-a.alfa.s-mxs.net.
TLS certificate: Issued by DigiCert Global CA G2 on May 24th 2023. Valid for: a year.

This is the only time idp-a.alfa.s-mxs.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	95.217.110.83 95.217.110.83	24940 (HETZNER-AS) (HETZNER-AS)
1	142.250.185.227 142.250.185.227	15169 (GOOGLE) (GOOGLE)
2	213.150.12.249 213.150.12.249	12895 (IT-AUSTRI...) (IT-AUSTRIA Vienna)
23	4

3 95.217.110.83 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: n1.staging.engage.teamviewer.com

fat.remote-support.sparkasse.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.150.12.249 (Austria)

ASN12895 (IT-AUSTRIA Vienna, Austria, AT)

idp-a.alfa.s-mxs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	sparkasse.at fat.remote-support.sparkasse.at	9 KB
2	s-mxs.net idp-a.alfa.s-mxs.net	16 KB
1	gstatic.com www.gstatic.com	19 KB
23	3

	Domain	Requested by
3	fat.remote-support.sparkasse.at	fat.remote-support.sparkasse.at
2	idp-a.alfa.s-mxs.net	fat.remote-support.sparkasse.at
1	www.gstatic.com	fat.remote-support.sparkasse.at
23	3

This site contains no links.

Subject Issuer	Validity	Valid
argo.engage.teamviewer.com R3	`2024-02-24` - `2024-05-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
idp-a.s-itsolutions.com DigiCert Global CA G2	`2023-05-24` - `2024-05-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://idp-a.alfa.s-mxs.net/kerberoslogin/authorize?response_type=token&client_id=B01255E3&redirect_uri=https%3A%2F%2Fauth.staging.engage.teamviewer.com%2Foauth%2Fforce%2Ferstegeorge
Frame ID: BF9FA44A818A55A1ECF826411DD4DD5E
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ALFA Authentication

Page URL History Show full URLs

http://fat.remote-support.sparkasse.at/ HTTP 307
https://fat.remote-support.sparkasse.at/ Page URL
https://idp-a.alfa.s-mxs.net/kerberoslogin/authorize?response_type=token&client_id=B01255E3&redirect_uri=... Page URL

Detected technologies

amCharts (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

amcharts.*\.js

Page Statistics

23
Requests

26 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

44 kB
Transfer

629 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://fat.remote-support.sparkasse.at/ HTTP 307
https://fat.remote-support.sparkasse.at/ Page URL
https://idp-a.alfa.s-mxs.net/kerberoslogin/authorize?response_type=token&client_id=B01255E3&redirect_uri=https%3A%2F%2Fauth.staging.engage.teamviewer.com%2Foauth%2Fforce%2Ferstegeorge Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://fat.remote-support.sparkasse.at/ HTTP 307
https://fat.remote-support.sparkasse.at/

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
fat.remote-support.sparkasse.at/
Redirect Chain

http://fat.remote-support.sparkasse.at/
https://fat.remote-support.sparkasse.at/

9 KB
9 KB

207ms
57ms

Document
text/html

95.217.110.83
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://fat.remote-support.sparkasse.at/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

95.217.110.83 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),

Reverse DNS

n1.staging.engage.teamviewer.com

Software

istio-envoy /

Resource Hash

74393fc9d244cb2837ac1917a5a0597db2db2be658717a4811830c1bf9e8ec5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-AT,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 9157
content-type: text/html
date: Tue, 16 Apr 2024 12:34:58 GMT
etag: "6615245e-23c5"
last-modified: Tue, 09 Apr 2024 11:19:58 GMT
server: istio-envoy
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-envoy-upstream-service-time: 1

Redirect headers

Location: https://fat.remote-support.sparkasse.at/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 loader.js Show response
www.gstatic.com/charts/ 61 KB
19 KB 110ms
32ms Script
text/javascript 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/loader.js

Requested by

Host: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

369ae154eab37b7ada7776b934833183bb053ebd1d0255f70ef8944f65cabb0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fat.remote-support.sparkasse.at/
Accept-Language: de-AT,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 12:01:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2015
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18534
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 17:52:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Tue, 16 Apr 2024 13:01:23 GMT

GET
H2 200 core.js
fat.remote-support.sparkasse.at/init/amcharts/ 423 KB
0 67ms
63ms Script
application/javascript 95.217.110.83
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://fat.remote-support.sparkasse.at/init/amcharts/core.js

Requested by

Host: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

95.217.110.83 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),

Reverse DNS

n1.staging.engage.teamviewer.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fat.remote-support.sparkasse.at/
Accept-Language: de-AT,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 12:34:58 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 11:19:58 GMT
server: istio-envoy
etag: "6615245e-100224"
content-type: application/javascript
cache-control: no-cache
x-envoy-upstream-service-time: 2
accept-ranges: bytes
content-length: 1049124

GET
H2 200 charts.js
fat.remote-support.sparkasse.at/init/amcharts/ 121 KB
0 170ms
166ms Script
application/javascript 95.217.110.83
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://fat.remote-support.sparkasse.at/init/amcharts/charts.js

Requested by

Host: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

95.217.110.83 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),

Reverse DNS

n1.staging.engage.teamviewer.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fat.remote-support.sparkasse.at/
Accept-Language: de-AT,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 12:34:58 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Tue, 09 Apr 2024 11:19:58 GMT
server: istio-envoy
etag: "6615245e-23c7b"
content-type: application/javascript
cache-control: no-cache
x-envoy-upstream-service-time: 2
accept-ranges: bytes
content-length: 146555

GET animated.js
fat.remote-support.sparkasse.at/init/amcharts/themes/ 0
0

GET material.js
fat.remote-support.sparkasse.at/init/amcharts/themes/ 0
0

GET en_US.js
fat.remote-support.sparkasse.at/init/amcharts/i18n/ 0
0

GET de_DE.js
fat.remote-support.sparkasse.at/init/amcharts/i18n/ 0
0

GET ja_JP.js
fat.remote-support.sparkasse.at/init/amcharts/i18n/ 0
0

GET ru_RU.js
fat.remote-support.sparkasse.at/init/amcharts/i18n/ 0
0

GET uk_UA.js
fat.remote-support.sparkasse.at/init/amcharts/i18n/ 0
0

GET stomp.min.js
fat.remote-support.sparkasse.at/init/sockjs/ 0
0

GET logo.svg
fat.remote-support.sparkasse.at/content/images/ 0
0

GET runtime.32d74dd864b2e528.js
fat.remote-support.sparkasse.at/ 0
0

GET polyfills.6e9c877ce0e5e46b.js
fat.remote-support.sparkasse.at/ 0
0

GET scripts.41d2915a1d5d0c3a.js
fat.remote-support.sparkasse.at/ 0
0

GET main.445c7a9d4943ea66.js
fat.remote-support.sparkasse.at/ 0
0

GET init.css
fat.remote-support.sparkasse.at/init/ 0
0

GET default-skin.css
fat.remote-support.sparkasse.at/init/photoswipe/ 0
0

GET photoswipe.css
fat.remote-support.sparkasse.at/init/photoswipe/ 0
0

GET flag-icon.min.css
fat.remote-support.sparkasse.at/init/css/ 0
0

GET
H/1.1 200 Primary Request authorize Show response
idp-a.alfa.s-mxs.net/kerberoslogin/ 628 B
1 KB 142ms
29ms Document
text/html 213.150.12.249
IT-AUSTRIA Vienna

General

Check archive.org

Show headers Download Go to

Full URL

https://idp-a.alfa.s-mxs.net/kerberoslogin/authorize?response_type=token&client_id=B01255E3&redirect_uri=https%3A%2F%2Fauth.staging.engage.teamviewer.com%2Foauth%2Fforce%2Ferstegeorge

Requested by

Host: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.150.12.249 , Austria, ASN12895 (IT-AUSTRIA Vienna, Austria, AT),

Reverse DNS

Software

Resource Hash

5162f46017b9412e89f542a3cb008db6eaf44caf6bf87cf336fea5b3ffc747b8

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'self'; font-src 'self'; img-src 'self'; frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-AT,de;q=0.9;q=0.9
Referer: https://fat.remote-support.sparkasse.at/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache, no-store
Connection: keep-alive
Content-Length: 628
Content-Security-Policy: default-src 'none'; style-src 'self'; font-src 'self'; img-src 'self'; frame-ancestors 'self'
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 16 Apr 2024 12:34:58 GMT
Keep-Alive: timeout=120
Pragma: no-cache
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 favicon.ico
idp-a.alfa.s-mxs.net/ 15 KB
15 KB 31ms
31ms Other
image/x-icon 213.150.12.249
IT-AUSTRIA Vienna

General

Check archive.org

Show headers Download Go to

Full URL: https://idp-a.alfa.s-mxs.net/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.150.12.249 , Austria, ASN12895 (IT-AUSTRIA Vienna, Austria, AT),
Reverse DNS
Software: /
Resource Hash: 71fba39b8a830dc86c1aca47dd88012a297f0ca7ac4dc28f114ed59486b18002

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://idp-a.alfa.s-mxs.net/kerberoslogin/authorize?response_type=token&client_id=B01255E3&redirect_uri=https%3A%2F%2Fauth.staging.engage.teamviewer.com%2Foauth%2Fforce%2Ferstegeorge
Accept-Language: de-AT,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 12:34:58 GMT
Last-Modified: Wed, 22 Nov 2023 07:28:27 GMT
ETag: W/"15086-1700638107000"
Content-Type: image/x-icon
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=120
Content-Length: 15086

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/themes/animated.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/themes/material.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/i18n/en_US.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/i18n/de_DE.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/i18n/ja_JP.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/i18n/ru_RU.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/amcharts/i18n/uk_UA.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/sockjs/stomp.min.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/content/images/logo.svg

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/runtime.32d74dd864b2e528.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/polyfills.6e9c877ce0e5e46b.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/scripts.41d2915a1d5d0c3a.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/main.445c7a9d4943ea66.js

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/init.css

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/photoswipe/default-skin.css

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/photoswipe/photoswipe.css

Domain: fat.remote-support.sparkasse.at
URL: https://fat.remote-support.sparkasse.at/init/css/flag-icon.min.css

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			idp-a.alfa.s-mxs.net/kerberoslogin	1969-12-31 23:59:59	Name: JSESSIONID Value: B109BB61A9806A6A056E307FBF2A807A.2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fat.remote-support.sparkasse.at
idp-a.alfa.s-mxs.net
www.gstatic.com
fat.remote-support.sparkasse.at
142.250.185.227
213.150.12.249
95.217.110.83
369ae154eab37b7ada7776b934833183bb053ebd1d0255f70ef8944f65cabb0c
5162f46017b9412e89f542a3cb008db6eaf44caf6bf87cf336fea5b3ffc747b8
71fba39b8a830dc86c1aca47dd88012a297f0ca7ac4dc28f114ed59486b18002
74393fc9d244cb2837ac1917a5a0597db2db2be658717a4811830c1bf9e8ec5d

idp-a.alfa.s-mxs.net Open in urlscan Pro 213.150.12.249 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

26 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

44 kBTransfer

629 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

idp-a.alfa.s-mxs.net Open in urlscan Pro
213.150.12.249 Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

26 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

44 kB
Transfer

629 kB
Size

1
Cookies

23 HTTP transactions
0 data transactions