verifypendingtractkeystone.mein-vigor.de Open in urlscan Pro
210.16.121.79  Malicious Activity! Public Scan

URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Submission: On July 27 via automatic, source openphish — Scanned from DE

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 210.16.121.79, located in Singapore and belongs to HOSTUS-GLOBAL-AS HostUS, HK. The main domain is verifypendingtractkeystone.mein-vigor.de.
TLS certificate: Issued by R3 on July 26th 2022. Valid for: 3 months.
This is the only time verifypendingtractkeystone.mein-vigor.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: KeyBank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 210.16.121.79 7489 (HOSTUS-GL...)
8 16 45.60.198.48 19551 (INCAPSULA)
1 88.221.62.16 16625 (AKAMAI-AS)
11 4
Apex Domain
Subdomains
Transfer
16 commercebank.com
banking.commercebank.com — Cisco Umbrella Rank: 195964
6 KB
1 key.com
www.key.com — Cisco Umbrella Rank: 86425
2 KB
1 mein-vigor.de
verifypendingtractkeystone.mein-vigor.de
13 KB
0 mandtbank.com Failed
onlinebanking.mandtbank.com Failed
11 4
Domain Requested by
16 banking.commercebank.com 8 redirects verifypendingtractkeystone.mein-vigor.de
1 www.key.com verifypendingtractkeystone.mein-vigor.de
1 verifypendingtractkeystone.mein-vigor.de
0 onlinebanking.mandtbank.com Failed verifypendingtractkeystone.mein-vigor.de
11 4

This site contains links to these domains. Also see Links.

Domain
banking.key.com
Subject Issuer Validity Valid
verifypendingtractkeystone.mein-vigor.de
R3
2022-07-26 -
2022-10-24
3 months crt.sh
online.key.com
DigiCert EV RSA CA G2
2022-06-07 -
2022-11-30
6 months crt.sh

This page contains 1 frames:

Primary Page: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Frame ID: 2B26A05863289EB5C789C87473470FD5
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Online Identity Verification Process - Key Bank, N.A.

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

11
Requests

18 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

15 kB
Transfer

37 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/global_all.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 1
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/standard_all.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 2
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/global_screen.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 3
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/standard_screen.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 4
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/ajax.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 5
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/niftyCorners.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 8
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/global_print.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
Request Chain 9
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/standard_print.css HTTP 302
  • https://banking.commercebank.com/cbi/pagenotfound.aspx

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request verify.php
verifypendingtractkeystone.mein-vigor.de/keystone/
35 KB
13 KB
Document
General
Full URL
https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
210.16.121.79 , Singapore, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK),
Reverse DNS
Software
nginx /
Resource Hash
fe6d9ebc45278e7e309ddd788a5f9cf0da71bc7f76b65c002b108e5d6dc083e2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Length
12790
Content-Type
text/html; charset=UTF-8
Date
Wed, 27 Jul 2022 14:21:01 GMT
Server
nginx
Vary
Accept-Encoding
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/global_all.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:02 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
7-24937756-24935284 3NNN RT(1658931661984 139) q(0 0 0 0) r(8 8) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/standard_all.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:02 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
0-10915310-10915309 3NNN RT(1658931661985 146) q(0 0 0 0) r(10 10) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/global_screen.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:02 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
8-26300000-26299366 3NNN RT(1658931661985 137) q(0 0 0 0) r(10 10) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/standard_screen.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:02 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
3-22647451-22647028 3NNN RT(1658931661984 143) q(0 0 0 0) r(10 10) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/ajax.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:02 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
0-10915311-10914245 3NNN RT(1658931661985 147) q(0 0 0 6) r(10 10) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/niftyCorners.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:02 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
7-24937757-24936459 3NNN RT(1658931661984 140) q(0 0 0 4) r(10 10) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
logo.png
www.key.com/kco/images/
2 KB
2 KB
Image
General
Full URL
https://www.key.com/kco/images/logo.png
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.221.62.16 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-62-16.deploy.static.akamaitechnologies.com
Software
Akamai Image Manager /
Resource Hash
cab440addc7a18ab69e51b5ceaca5effa930751fcec8436793c8f2cb0f34216d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 27 Jul 2022 14:21:03 GMT
x-check-cacheable
YES
x-serial
1614
x-im-policy-version
1
content-type
image/webp
cache-control
private, no-transform, max-age=43200
last-modified
Wed, 27 Jul 2022 09:00:30 GMT
intercept
true
content-length
2006
server
Akamai Image Manager
expires
Thu, 28 Jul 2022 02:21:03 GMT
ErrorIndicator.gif
onlinebanking.mandtbank.com/layouts/images/
0
0

pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/global_print.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:04 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
5-30683909-30682517 3NNN RT(1658931663868 44) q(0 0 0 5) r(10 10) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE
pagenotfound.aspx
banking.commercebank.com/cbi/
Redirect Chain
  • https://banking.commercebank.com/CBI/Themes/LeftMenu/CSS/standard_print.css
  • https://banking.commercebank.com/cbi/pagenotfound.aspx
0
0
Stylesheet
General
Full URL
https://banking.commercebank.com/cbi/pagenotfound.aspx
Requested by
Host: verifypendingtractkeystone.mein-vigor.de
URL: https://verifypendingtractkeystone.mein-vigor.de/keystone/verify.php
Protocol
HTTP/1.1
Server
45.60.198.48 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://verifypendingtractkeystone.mein-vigor.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Redirect headers

Strict-Transport-Security
max-age=31536000
Server
Microsoft-IIS/8.5
Date
Wed, 27 Jul 2022 14:21:04 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Location
https://banking.commercebank.com/cbi/pagenotfound.aspx
X-Iinfo
5-30683934-30683866 3NNN RT(1658931664038 43) q(0 0 0 0) r(11 11) U11
X-XSS-Protection
1; mode=block
Content-Length
177
X-CDN
Imperva
X-UA-Compatible
IE=EDGE

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
onlinebanking.mandtbank.com
URL
https://onlinebanking.mandtbank.com/layouts/images/ErrorIndicator.gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: KeyBank (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| gVAM_ValFlds boolean| gVAM_PostOnChange boolean| gVAM_PostOnSubmit string| gVAM_ErrCtlCss string| gVAM_TxtHFCss string| gVAM_NonTxtHFCss string| gVAM_AlertTemplate string| gVAM_AlertLeadText boolean| gVAM_AlertListStyle number| gVAMBlinkTime number| gVAMBlinkOnChange number| gVAMBlinkOnSubmit object| gVAMSubOrder undefined| gVAMActions undefined| gVAMSubmitIDs number| noCookieIndex function| NiftyLoad

0 Cookies