sparkasse.meinepoba.live
Open in
urlscan Pro
2606:4700:30::681b:bfd4
Malicious Activity!
Public Scan
Effective URL: https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/mybanking_login?22998556=22998556&idloginform=52499367196...
Submission Tags: 6080668
Submission: On June 16 via api from US
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on June 13th 2019. Valid for: a year.
This is the only time sparkasse.meinepoba.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.64.119.163 192.64.119.163 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
3 19 | 2606:4700:30:... 2606:4700:30::681b:bfd4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
18 | 2 |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
media4tek.info |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
sparkasse.meinepoba.live |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
meinepoba.live
3 redirects
sparkasse.meinepoba.live |
412 KB |
2 |
jquery.com
code.jquery.com |
60 KB |
1 |
media4tek.info
1 redirects
media4tek.info |
237 B |
18 | 3 |
Domain | Requested by | |
---|---|---|
19 | sparkasse.meinepoba.live |
3 redirects
sparkasse.meinepoba.live
|
2 | code.jquery.com |
sparkasse.meinepoba.live
|
1 | media4tek.info | 1 redirects |
18 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-06-13 - 2020-06-12 |
a year | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/mybanking_login?22998556=22998556&idloginform=52499367196066729841525582171869043481868868678616863352336020753777393219138355959855747286686137045724426810800984645893913300742585179905079970918788619718537615707904967774303167679971450598312577992721126508450927840365365211597613438499028989848960508931091271147090687797822798569814990418951510787643175220681402204169462928460013863839711616413052273117352204371381129359500248145287024802870262851342999621573649685212471904424611006775067945885887237555175310666007292373311184568939163427
Frame ID: EE04552675199231128847BE72F53B1F
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://media4tek.info/
HTTP 302
http://sparkasse.meinepoba.live/ HTTP 301
https://sparkasse.meinepoba.live/ Page URL
-
https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr
HTTP 301
http://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ HTTP 301
https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ Page URL
- https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/mybanking_login?22998556=22998556&idl... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://media4tek.info/
HTTP 302
http://sparkasse.meinepoba.live/ HTTP 301
https://sparkasse.meinepoba.live/ Page URL
-
https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr
HTTP 301
http://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ HTTP 301
https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ Page URL
- https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/mybanking_login?22998556=22998556&idloginform=52499367196066729841525582171869043481868868678616863352336020753777393219138355959855747286686137045724426810800984645893913300742585179905079970918788619718537615707904967774303167679971450598312577992721126508450927840365365211597613438499028989848960508931091271147090687797822798569814990418951510787643175220681402204169462928460013863839711616413052273117352204371381129359500248145287024802870262851342999621573649685212471904424611006775067945885887237555175310666007292373311184568939163427 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://media4tek.info/ HTTP 302
- http://sparkasse.meinepoba.live/ HTTP 301
- https://sparkasse.meinepoba.live/
- https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr HTTP 301
- http://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ HTTP 301
- https://sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
sparkasse.meinepoba.live/ Redirect Chain
|
3 KB 1004 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.2.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.2.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
mybanking_login
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ |
24 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
functions.js
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assets/js/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sparstyle.css
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
544 KB 66 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assets/js/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log.jpg
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
secure.jpg
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
diewelt.png
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IHKberlin.png
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
T%C3%BCv.jpg
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
344 B 344 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iconhome.jpg
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/ |
23 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Sparkasse_web_Rg.woff
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/internetfiliale/fonts/ |
39 KB 39 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pictos-if.woff
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/internetfiliale/fonts/ |
89 KB 89 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Sparkasse_web_Bd.woff
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/assetcss/internetfiliale/fonts/ |
39 KB 39 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timezone.php
sparkasse.meinepoba.live/banking/o7yu2hntxak8pzl1qfsc3bje5940vr/ |
0 192 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| Aes object| Base64 object| Utf8 string| he12p string| gea string| output string| ctrTxt function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.meinepoba.live/ | Name: __cfduid Value: d9b32a027fe0fca2202e51f35eb25b5181560710778 |
|
sparkasse.meinepoba.live/ | Name: PHPSESSID Value: 2btm38ci23cnc2dmvaej6scg10 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
media4tek.info
sparkasse.meinepoba.live
192.64.119.163
205.185.208.52
2606:4700:30::681b:bfd4
2ffbacd679de50201ee51be3fc911f22fe2b2a55747e3871274d997b5c700349
4e9d76339ec9cd9a4722e926ad694c409b38980131dd3198b15147f15d8c96e3
581672c1b52348baf0503666a693f8cbcdf63916cea8a798b0a3c98c677d6b5d
58e82d45f5fd5f051b4b2c5f62504f0b5033d418a3f13c55bd37ff99398536c6
622cdddf9135812f42c5b6396df2b08c836819bb84d0bcd9e82e779d0a4ad469
65af6ffa81ab87cc269ca670cd2f6153e6dd02f82d3e97a2014d5ebcd4c1c593
6bc2191fd19b051d5f8ebe3e706e5ae553881b945f85ccbfd9ca20bb9426b542
6de2594850a4d1576aadd021efd5c11a1ca169556c06c9cdb4b0f211ab26eb82
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9ab0dfe998556e29c04841d088bd8fb9bbdb84f844223765492d0b4c98ad6ba7
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2
ab62f83fa50bf346b6daa2534e5b7e1870fa4e6860e88aa8008193777051d5c4
d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855