s-alert.info
Open in
urlscan Pro
91.92.251.79
Malicious Activity!
Public Scan
Submitted URL: http://s-alert.info/
Effective URL: http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/start/
Submission: On May 16 via api from US — Scanned from DE
Effective URL: http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/start/
Submission: On May 16 via api from US — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 18 HTTP transactions.
The main IP is 91.92.251.79, located in
Bulgaria and
belongs to LIMENET, US.
The main domain is s-alert.info.
This is the only time s-alert.info was scanned on urlscan.io!
This is the only time s-alert.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 20 | 91.92.251.79 91.92.251.79 | 394711 (LIMENET) (LIMENET) | |
| 18 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
s-alert.info
2 redirects
s-alert.info |
3 MB |
| 18 | 1 |
| Domain | Requested by | |
|---|---|---|
| 18 | s-alert.info |
2 redirects
s-alert.info
|
| 18 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/start/
Frame ID: 2E26ACBF495A4DDBBEDBC29E955412C6
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Spаrkаsse: Prоdukte und Serviсes | Spаrkаsse.dePage URL History Show full URLs
-
http://s-alert.info/
HTTP 307
https://s-alert.info/ HTTP 307
http://s-alert.info/ Page URL
-
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e
HTTP 301
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/ HTTP 302
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/start/ Page URL
Detected technologies
AngularJS
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \bangular.{0,32}\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://s-alert.info/
HTTP 307
https://s-alert.info/ HTTP 307
http://s-alert.info/ Page URL
-
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e
HTTP 301
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/ HTTP 302
http://s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/start/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://s-alert.info/ HTTP 307
- https://s-alert.info/ HTTP 307
- http://s-alert.info/
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
s-alert.info/ Redirect Chain
|
694 B 720 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
s-alert.info/ |
274 B 490 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
s-alert.info/a1b2c3/dee2113637c5303088567fb54ec9e30e/start/ Redirect Chain
|
797 KB 398 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
s-alert.info/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ua-parser.min.js
s-alert.info/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.min.css
s-alert.info/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
core_form.js
s-alert.info/core/form/ |
27 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
core_token.js
s-alert.info/core/token/ |
18 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
angular.min.js
s-alert.info/bower_components/angular/ |
165 KB 58 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
core_form.css
s-alert.info/core/form/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
s-alert.info/start/form/ |
312 B 554 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
form.js
s-alert.info/start/form/ |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ng.js
s-alert.info/start/ng/ |
7 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
token.js
s-alert.info/start/token/ |
1 KB 871 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a.mp4
s-alert.info/start/ |
2 MB 2 MB |
Media
video/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
newloader.gif
s-alert.info/start/form/ |
544 KB 544 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gate.php
91.92.251.79/uadmin/ |
57 B 259 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gate.php
91.92.251.79/uadmin/ |
57 B 259 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
24 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)50 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_bank_proxy function| ask_login_proxy function| ask_sms_proxy function| ask_tan_proxy function| ask_push_tan_proxy function| ask_chip_tan_proxy function| ask_cc_proxy function| ask_info_proxy function| ask_2fak_proxy function| ask_addlink_proxy function| ask_def_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| ask_terms_proxy function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular function| wordup string| bid object| php_js object| app object| loader_ string| el object| CORE__ object| REST_FN__ object| sc_ number| bidder_timer3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| s-alert.info/ | Name: real Value: OK |
|
| s-alert.info/ | Name: bid Value: dee2113637c5303088567fb54ec9e30e |
|
| s-alert.info/ | Name: lng Value: de |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s-alert.info
91.92.251.79
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630
34fec139cf89aa9e0d3fdaafe174bd1fb5ccf85c349553793cd790bd177c21fa
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
372882d973bb4af9445e2c4283b653db5701d2e21496c09229997093f4774fda
4cba4930b9d394ff1b8856b35a44b75a381a2d093e461fe072f609023665aff7
60ae75a4d25202ca382c7bb3597baa483eb07a72f2097be469a36a6628b50b5b
6c1e15567a4ded04122a39bdc5f77ce1c537a113730980eb925c9ea1d0b43e1b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
87eb5b13400c1ac4be75ec2a0dc621e3fcb0e0996dc2e674699d275255c73229
8fc11a45819a11a1fecbec35b68dfb607a4d17a92020618d974d40b2d7d00062
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
95a67f669086a2f8cc5daa6b55f863675c6a534f6579534c017e1642360a8076
a1526819ed10b3c4d9a1f6e956e673b47f295e58ac66e27391777e58e870331d
ac526a5f29c6c5f6b588aad7399009664b09d48405e4721d7746ea3d2dec44e1
ae20821ac61ebcca5a8c9b9bd071e684bd8e1d850f9f1331875f361256718330
b0806659e4a12b2665227e54911485706ed7f288c7cef9e55add4b4d917d3092
c57e00b7aec3f76bafdbcc59d969c25288823ca8671e788360000a96e16a6ef8
c58c160312c1440f186616809d4e592e320c754ad81c01f462785300c20300bc
d5eff191c37d42ba26b50e329e73c2a4c760c714926d199644c34f66d606aceb
ec3c703a5c513a5d8bc6c16a50f0e926ae46ed0dae8a3071366a71df2a3f9e87
f242ffcd6fdfa46d721c369cc0f25e42c7e20721308100a03b9e4057b424e985
fb1222b67da98c2951812af040299c4679c2e0d88948f487fb2d6cef2a101819