www.sicherheitcenter-sp1.top
Open in
urlscan Pro
2400:cb00:2048:1::6818:7534
Malicious Activity!
Public Scan
Effective URL: https://www.sicherheitcenter-sp1.top/de/home/anmelden?xw2p1WyFuJ7E=99341961035145&1iMNljkoImlg1P08tX=5RoeO4lPoTYN&401284518241
Submission: On September 05 via automatic, source phishtank
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on September 2nd 2018. Valid for: 6 months.
This is the only time www.sicherheitcenter-sp1.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
1 1 | 2400:cb00:204... 2400:cb00:2048:1::6818:75fd | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 16 | 2400:cb00:204... 2400:cb00:2048:1::6818:7534 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
15 | 1 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
shortxr5.co |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.sicherheitcenter-sp1.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
sicherheitcenter-sp1.top
1 redirects
www.sicherheitcenter-sp1.top |
142 KB |
1 |
shortxr5.co
1 redirects
shortxr5.co |
307 B |
1 |
bit.ly
1 redirects
bit.ly |
352 B |
15 | 3 |
Domain | Requested by | |
---|---|---|
16 | www.sicherheitcenter-sp1.top |
1 redirects
www.sicherheitcenter-sp1.top
|
1 | shortxr5.co | 1 redirects |
1 | bit.ly | 1 redirects |
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni225191.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-02 - 2019-03-11 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.sicherheitcenter-sp1.top/de/home/anmelden?xw2p1WyFuJ7E=99341961035145&1iMNljkoImlg1P08tX=5RoeO4lPoTYN&401284518241
Frame ID: 8C7ED1E554E3635024A3733876B43BAF
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bit.ly/2C6FzOh
HTTP 301
https://shortxr5.co/?l=y5Rt8DJN HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden?xw2p1WyFuJ7E=99341961035145&1iMNljkoImlg1P08tX=5RoeO4lPoTYN... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.ly/2C6FzOh
HTTP 301
https://shortxr5.co/?l=y5Rt8DJN HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden?xw2p1WyFuJ7E=99341961035145&1iMNljkoImlg1P08tX=5RoeO4lPoTYN&401284518241 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
anmelden
www.sicherheitcenter-sp1.top/de/home/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R988cc287bb3001ce134f49cc4f8e03d18e2b2f56
www.sicherheitcenter-sp1.top/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rc98d5d29f822271d866da3dc2ad3b0bcee4db768
www.sicherheitcenter-sp1.top/ |
16 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R75b6fa09688b3dc23986a5f27dc55818803af607
www.sicherheitcenter-sp1.top/ |
84 KB 84 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rbf7253b8f957627d6f0016dc04b9c6667fc1ebb3
www.sicherheitcenter-sp1.top/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R1875129dd458a59136af1db82fa9314544b433a2
www.sicherheitcenter-sp1.top/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R4a53a0331952c66a9689cb1c7249e5e54312902a
www.sicherheitcenter-sp1.top/ |
4 KB 1 KB |
Script
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rd72a371231911864c8d3dd5e3587c43ace8240aa
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R82082a8c88956d87765aec91351e20fd704c823d
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Ra0351ae1edd6188a0c6718f73560d71f692d358d
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rf70761174edc1beb84e0817dec6a2f37115d074b
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R12c6bb731e6d6d241b9a5b731908512135a03d72
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R5c5a961453c5ff4002cd04d41088b1bb729df448
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rbe30a2708eede385422a0b3a4ce85bb467f8e44c
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R698b4ac938a52bf6926dd0ad3a9f30442bf8a6bd
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| R54e371f5959a4923410ad9368cee25169c165bdc function| Rdd0e044d9313705e685e3790c55f906bb85681782 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.sicherheitcenter-sp1.top/ | Name: PHPSESSID Value: pil0ik7ndqp6fl4j4brercplr6 |
|
.sicherheitcenter-sp1.top/ | Name: __cfduid Value: d7f7ea9448439ab3cb4f24ac89ea6bfdf1536185584 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
shortxr5.co
www.sicherheitcenter-sp1.top
2400:cb00:2048:1::6818:7534
2400:cb00:2048:1::6818:75fd
67.199.248.10
2e32b15e1615065c4796929fdd2aef481f7a07d351067c1eac34eaba1debef62
3940736ed23c56a6108f3672e9d7057e5c1e0d9c8e5760d878cbbd270f8e2e7b
4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753
74bcd86bc937c41e4045ef2a14f6619ffc828ceeca96e7c1946330c34abba648
b9797829fb133b5c591029045635cdb8166fbec2f2fd73d26b025d5287ea0209
bd2acb7af43eda560d76cf0c3d7e1a288211137ffc334d04a8c2f2c885dba644
d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288