extern-sparkasse-attack.blueits.workers.dev Open in urlscan Pro
172.67.202.93 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://extern-sparkasse-attack.blueits.workers.dev/
Effective URL:
https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html
Submission Tags: @phish_report
Submission: On August 30 via api (August 30th 2024, 4:39:02 pm UTC) from FI — Scanned from FI

Summary HTTP 35 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 35 HTTP transactions. The main IP is 172.67.202.93, located in United States and belongs to CLOUDFLARENET, US. The main domain is extern-sparkasse-attack.blueits.workers.dev.
TLS certificate: Issued by WE1 on August 12th 2024. Valid for: 3 months.

This is the only time extern-sparkasse-attack.blueits.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 19	172.67.202.93 172.67.202.93	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.85.1.81 185.85.1.81	20546 (SOPRADO-ANY) (SOPRADO-ANY)
35	3

19 172.67.202.93 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

extern-sparkasse-attack.blueits.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.85.1.81 (Germany)

ASN20546 (SOPRADO-ANY, DE)
PTR: ip-185-85-1-81.ax5z.com

www.sparkasse.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	workers.dev 2 redirects extern-sparkasse-attack.blueits.workers.dev	2 MB
1	sparkasse.de www.sparkasse.de — Cisco Umbrella Rank: 305599	581 B
0	sparkasse-amberg-suizbach.de Failed module.sparkasse-amberg-suizbach.de Failed
35	3

	Domain	Requested by
19	extern-sparkasse-attack.blueits.workers.dev	2 redirects extern-sparkasse-attack.blueits.workers.dev
1	www.sparkasse.de	extern-sparkasse-attack.blueits.workers.dev
0	module.sparkasse-amberg-suizbach.de Failed	extern-sparkasse-attack.blueits.workers.dev
35	3

This site contains no links.

Subject Issuer	Validity	Valid
blueits.workers.dev WE1	`2024-08-12` - `2024-11-10`	3 months	crt.sh
www.sparkasse.de D-TRUST SSL Class 3 CA 1 EV 2009	`2024-05-16` - `2025-05-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html
Frame ID: CA479CB644BE48A54CD79F8E8B291A62
Requests: 35 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://extern-sparkasse-attack.blueits.workers.dev/ HTTP 307
https://extern-sparkasse-attack.blueits.workers.dev/ HTTP 301
https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Page URL
https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/nonexistent.html HTTP 301
https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/clientlibs/

Page Statistics

35
Requests

51 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2026 kB
Transfer

5489 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://extern-sparkasse-attack.blueits.workers.dev/ HTTP 307
https://extern-sparkasse-attack.blueits.workers.dev/ HTTP 301
https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Page URL
https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/nonexistent.html HTTP 301
https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://extern-sparkasse-attack.blueits.workers.dev/ HTTP 307
https://extern-sparkasse-attack.blueits.workers.dev/ HTTP 301
https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Request Chain 22

https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/misc/break.html?type=jslog&url=https%3A%2F%2Fextern-sparkasse-attack.blueits.workers.dev%2Fde%2Fhome.html&stref=checkProxy&check=false&hostname=extern-sparkasse-attack.blueits.workers.dev&salt=HuyE5pYcno&hash=-1148157808&proof=664330676 HTTP 301
https://extern-sparkasse-attack.blueits.workers.dev/de/home/misc/break.html?type=jslog&url=https%3A%2F%2Fextern-sparkasse-attack.blueits.workers.dev%2Fde%2Fhome.html&stref=checkProxy&check=false&hostname=extern-sparkasse-attack.blueits.workers.dev&salt=HuyE5pYcno&hash=-1148157808&proof=664330676

35 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

home.html Show response
extern-sparkasse-attack.blueits.workers.dev/de/
Redirect Chain

http://extern-sparkasse-attack.blueits.workers.dev/
https://extern-sparkasse-attack.blueits.workers.dev/
https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

87 KB
14 KB

603ms
602ms

Document
text/html

172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34a3c587d112b5a4e3f6d005367a3922cc5c740bd7e3a07db192a4b351059644

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' blob: https://morris-server.de:8801 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' data: blob: https://api.sparkassen-mediacenter.de https://sparkassen-mediacenter.de https://cdn.sparkassen-mediacenter.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache,no-store,private,max-age=0,must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8bb636a3587d56cb-OSL
content-encoding: br
content-language: de-DE
content-security-policy: script-src 'self' blob: https://morris-server.de:8801 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' data: blob: https://api.sparkassen-mediacenter.de https://sparkassen-mediacenter.de https://cdn.sparkassen-mediacenter.de
content-type: text/html;charset=UTF-8
date: Fri, 30 Aug 2024 16:38:50 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s0PqusB%2Fdf1SBsK279k4DbnxlLabYhGoI1LV%2BGhpxoSTaPz%2FU4ViAOKm39KnyCg34NsZ%2BjfhE7n1fEBUDhONTOxMjyqGsDSvBogwaPgDMpBwLBvjiyLcPXmgKrJQ8t7V9e3zjPBjQNW8EMIGdp%2F60%2B%2BK5u2J5XHXUTzNP9wz"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: If-Modified-Since,Accept-Encoding,User-Agent
x-content-type-options: nosniff
x-frame-options: DENY
x-tlscipher: checked
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8bb6369f593d56cb-OSL
content-type: text/html; charset=iso-8859-1
date: Fri, 30 Aug 2024 16:38:49 GMT
location: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2bOWsptwBc0eXe48vnWS9WKTbUR9HgAnBniXii7CiYBVtMIeRFBf1mdTD9TN7%2BXc28jnDqmyfO%2Bs78YPpgQniajbEYXFnMJQ%2FLnFlbiABdZWV3lq4pukTPiqhXuDSN3ctpgupPfs4qb3GgUyP0E6rH5IBonrM3%2Be%2B3f2Wyw5"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-tlscipher: checked
x-ua-compatible: IE=edge

GET
H2 200 internetfiliale.min.ab44bc1b4d286a05464a3464f3761664.css
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/ 3 MB
285 KB 1186ms
1185ms Stylesheet
text/css 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale.min.ab44bc1b4d286a05464a3464f3761664.css

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19b5fad9a3fc6b8ffb02849e198c9bbcf4280e267d14081f3265fc69fa9ec552

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:51 GMT
content-encoding: gzip
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=86400
x-ua-compatible: IE=edge
last-modified: Fri, 30 Aug 2024 14:02:50 GMT
server: cloudflare
etag: "300bfe-620e70bf0bafd"
vary: Accept-Encoding,User-Agent
x-frame-options: DENY
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9R0m2RclTJWHZaC6W9KigAfUR%2FUiWPdDsmYRksHtThkLb2m4lsbNuguSVIkk3lLkagAPZwtGYUlNvWitEOha0tKEk1v7H85mfEQjQ5RrRc%2FOL4thurkfoVk63S%2BD2MauqSZyMEa3L4bS5ZxZ2wMF6Pd310dl4Peys0I3%2Bs6"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
x-tlscipher: checked
cf-ray: 8bb636a72f8e56cb-OSL

GET
H2 200 internetfiliale.min.03b4878472432518c6a5fdd244ac9783.js Show response
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/ 739 KB
177 KB 623ms
622ms Script
text/javascript 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale.min.03b4878472432518c6a5fdd244ac9783.js

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0ec32bc9358eeaaf9e7ba8069871996b5f7a327b1e468ceeb6c710bde97d69b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:51 GMT
content-encoding: gzip
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=86400
x-ua-compatible: IE=edge
last-modified: Fri, 30 Aug 2024 14:01:37 GMT
server: cloudflare
etag: "b8bb3-620e707a2d308"
vary: Accept-Encoding,User-Agent
x-frame-options: DENY
content-type: text/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=56gS5zG6faUf4GUWdhvupoH48KXk9g2mRKQJABpOzA6kA24EXnhN2COiNicwA1x4Q55Y8cR0igGLReKvCgIPUNQbJXbKJ6xhbXtVYZam2H03uONvqwrkhJ%2FMHQqb0w7bxANykoKVosqXCtu1C8c0olIk2sALOBKHyQtxqLjV"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
x-tlscipher: checked
cf-ray: 8bb636a7780e56cb-OSL

GET
H2 200 logo_weiss.svg
extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/nbf-logos/ 8 KB
3 KB 404ms
404ms Image
image/svg+xml 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/nbf-logos/logo_weiss.svg

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3e108e2717696b055411fa5b6f634d6a726cafce12e1648c3895c17dc74fd29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:51 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: W/"1ef5-620d3d1b19c9a"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LUcnpkzhJnMm3iSTeQY%2B83cxNhV2FRNimyu9%2Ff9GsyCUVcFDUqyowaX%2FSnSdfObERJ%2FMJOHVkwy2D5Uc%2F6NGYHvY6Rg3VQjmPF0gMSaTowvhIdp8NnTAXF%2FSoLj5HY1z%2FQbxlpaemjMkaIem4vN4wXrnu0Dl4wwzwR00E5rn"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
cf-ray: 8bb636a7781256cb-OSL

GET
H2 200 spk-logo-druck.png
extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/Logos/ 12 KB
13 KB 413ms
412ms Image
image/png 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/Logos/spk-logo-druck.png

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fd8120391ed2925249baf5fb54bf0b2d9c3aec0a5f4933ab60536209dbcb05e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:51 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 12505
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "30d9-620d3d1b1b40a"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jiCLIWng%2FcG%2BBqw1d1oNXZ3Y20uvEe2fX29EjpHq9ysp2qzIONG%2BhheAm3dhLt1MUkoqgofYWM1Gbncd5ytbVgJOW44D9aZY8PdjhERko0Rl%2BNsmbwEoEdKaZZ8JVcAt30kgsILBikgqc3pW3yeLK11kW%2FB3neHFe0dwhZSp"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636a7781456cb-OSL

GET
H2 200 logo_rot.svg
extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/nbf-logos/ 8 KB
3 KB 1294ms
1293ms Image
image/svg+xml 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/nbf-logos/logo_rot.svg

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f817eee319405982e5d58802a785f43585945abfa18ed7824121083ede62d87b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:51 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: W/"1ef5-620d3d1b34a4b"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3Ff7RD%2BPbcg2h0xNI63uAAHK7nwvbRwT5ZGcBfDFqVAFkpmNmejuDhQ7mE0Ed8MoicAR0hetD%2Fee%2F%2Bj9AYYzV3LquUr2YEX8j0AMpJA7VV4Kcl%2BjIkzMJBDyT8xr6whgHFjXc%2Bdc%2F2ic30SQqct3ZvyTjh5PbEeZ4e%2F2We4"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
cf-ray: 8bb636a9ab4a56cb-OSL

GET
H2 200 Bildmarke_S-Sparkasse_72px.svg
extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/nbf-logos/ 976 B
704 B 1400ms
1400ms Image
image/svg+xml 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/content/dam/myif/spk-amberg-sulzbach/work/bilder/nbf-logos/Bildmarke_S-Sparkasse_72px.svg

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4e07d2fb57dd99f228e0d5b6e4e7a8d051ae49bb9643d850ac10369a6158e35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:51 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: W/"3d0-620d3d1b34e33"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/svg+xml
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zme9wonnni47J1NWbO0I411b4lz5fLlkDn5mE8K0orDtwVDy3VjnhzDqvBhn6SsFmg1ukP67yV%2Bh%2F8ydojdOUUH4rTt%2BCmhjokjzLWgNBnWBGMqL5fzdqxDKX8dyp7mF3w30w8MHi7d3%2BHqfbLeBh1dVgn8nq%2ByHnyedHygW"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
cf-ray: 8bb636a9ebb556cb-OSL

GET
H2 200 1718282814854.png
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref4.epimgref.png/ 1 MB
1 MB 1738ms
1738ms Image
image/png 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref4.epimgref.png/1718282814854.png

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 1194230
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "1238f6-620d3d1b486b3"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M7rAmp%2B8KKOHj%2B2IndQ9xkW2II08FQjEDqZLZUKBQbVkfOIfloKeJR3G5bxqL%2BR6H61QA%2B6vDfDTp0%2BQKaxsaf0pf%2FhSo6RGquFa%2FWFZP1JaQ38fbWOL%2FK69PMBy8yclMkAb5oH0UemWpd8qgCAapWcSlY5dzurrSljOsoAA"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b338a356cb-OSL

GET
H2 200 1708518171056.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/homepagearea/parsys/teaserarea_0/teaserref1.epimgref.jpg/ 41 KB
41 KB 488ms
486ms Image
image/jpeg 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/homepagearea/parsys/teaserarea_0/teaserref1.epimgref.jpg/1708518171056.jpg

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 42014
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "a41e-620d3d1b4b1ac"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xr%2BNvoDf9rWRCjy4S3%2BBvdo%2BoF%2FLRS0F95ZYnM3mXjkXzdxTB9RLDCmmmXQnCNOJbiXhHC25Z32SHdWUKzOlJWpi0NCL5mC6Y4gqXn%2BhOygVGssN6TKCU1pK7UI%2B0TgI7rx%2FwXSnbF0K2fxUbqbq1NudTpo6Ym6hcsEf1cwZ"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b3e9cb56cb-OSL

GET
H2 200 1665662388260.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/homepagearea/parsys/teaserarea_0/teaserref2.epimgref.jpg/ 43 KB
43 KB 1044ms
1042ms Image
image/jpeg 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/homepagearea/parsys/teaserarea_0/teaserref2.epimgref.jpg/1665662388260.jpg

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 43880
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "ab68-620d3d1b559a4"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2Ff2o0J%2F8a2l4pZYVownHSpbMfQhurBMnzEDX4eqYUSkTaHTiO%2BFK6b1a9jmckOKKUxVtLX59%2FNW%2FIP07XMsLPUWMZtT6qEPSZn3Fib24%2BtCnSKo7p9VF%2B0VPVHx57T3gv4s7cJcfn0OCHWPdH9DzUAgx8DjAFt1I0hzvsC0"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b3e9cc56cb-OSL

GET
H2 200 1699863330470.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/homepagearea/parsys/teaserarea_0/teaserref3.epimgref.jpg/ 35 KB
35 KB 618ms
617ms Image
image/jpeg 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/homepagearea/parsys/teaserarea_0/teaserref3.epimgref.jpg/1699863330470.jpg

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 35748
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "8ba4-620d3d1b51354"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jHcsaGBSHumc%2B0tpe%2BZch6mOm68vrVY6Y5DLJFxxG6lnPt7GNQuzBL1uCEmQMvbd4WQ9KUVfG%2FhlKSG1qbrNWkXWRPXHUUatv4S%2FE1qQFtgFrGGKuXPNqWd%2BqiWI0%2Bgh71zHciFuDVo8eP4ukXojM5PJgVuu80fQNUNiBxJ1"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b3e9cf56cb-OSL

GET
H2 200 1720589959183.png
extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/ 33 KB
34 KB 350ms
349ms Image
image/png 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/siegel/_jcr_content/awards/parsys/award_1/image.img.png/1720589959183.png

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 34259
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "85d3-620d3d1b4f414"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qwqe4V%2F2L1rBGnEJuPehBsRkydzqkGhjpTrZldWQtqDuPKzQxsYWu3dgE%2B3U0kgD3g5%2BIngd4lEdUvraf2kZRYtW%2F25qQPiwm8o04H45uTnjxjXnWU2C%2Be9Ljzfrf6RLvFbOvJ%2FKDyk547SHXzzuLLEou8YrXtZbHcXqkKIT"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b3e9d256cb-OSL

GET
H2 200 1669821852452.png
extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/siegel/_jcr_content/awards/parsys/award_e430/image.img.png/ 28 KB
28 KB 1421ms
1420ms Image
image/png 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/siegel/_jcr_content/awards/parsys/award_e430/image.img.png/1669821852452.png

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 28767
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:28 GMT
server: cloudflare
etag: "705f-620d3d1b4d4d4"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2FwUZryMiV4Otet90Bc3V%2FzSv9tL46him%2BiDR2%2FDwxPp%2Fxp%2F6asX3KsgCbUatXxKKwfx3ko2yz5ou0bIAiU%2Fw3Hby6alHfYmQxi6aMRgGSxR2x4SnKZB6QBn5cXQcTq4JgtHXYfSHeDTulNxtZ26d0UpAgJbYTD9LYnIi8yY"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b3e9d656cb-OSL

GET
H2 200 setTrackingCookie.html
www.sparkasse.de/frontend/ 43 B
581 B 5289ms
4241ms Image
image/gif 185.85.1.81
SOPRADO-ANY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sparkasse.de/frontend/setTrackingCookie.html?blz=75250000

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.85.1.81 , Germany, ASN20546 (SOPRADO-ANY, DE),

Reverse DNS

ip-185-85-1-81.ax5z.com

Software

myracloud /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: myracloud
etag: "myra-b987464d"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=0
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 30 Aug 2024 16:38:54 GMT

GET tdg
module.sparkasse-amberg-suizbach.de/if/services/ 0
0

GET
H2 200 universal_analytics.min.83ffa79e473804f54815ff7051021911.js Show response
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/spk-amberg-sulzbach/sfp/ 49 KB
15 KB 365ms
365ms Script
text/javascript 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/spk-amberg-sulzbach/sfp/universal_analytics.min.83ffa79e473804f54815ff7051021911.js

Requested by

Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21d898da796edae24c1f0365bc477c2a25a9c407d72e11a7f84830c9dd3ea51a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:52 GMT
content-encoding: gzip
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=86400
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:06:58 GMT
server: cloudflare
etag: "c554-620d3d3796521"
vary: Accept-Encoding,User-Agent
x-frame-options: DENY
content-type: text/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XQ%2FEmSiVFPryefenXcxyBwO%2F%2FkYSE4QJmGFZ6uUQ4zwzPEuutGyzEJnGWTbK5CXV7B0X7Q9pDJOlXu%2BXRnHvOBhpt7EVkWlvNBxZZVEwsWxSPXOxw6A85PS%2Fb5ccOCP5AlPlBEok6tFfFJjUALlT2YE%2B23UyiHQqY7U%2FHbok"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b29fd456cb-OSL

GET Sparkasse_web_Rg.woff
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET pictos-if.woff
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Md.woff
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Bd.woff
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET SparkasseHead_web_Rg.woff
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Lt.woff
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET

break.html
extern-sparkasse-attack.blueits.workers.dev/de/home/misc/
Redirect Chain

https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/misc/break.html?type=jslog&url=https%3A%2F%2Fextern-sparkasse-attack.blueits.workers.dev%2F...
https://extern-sparkasse-attack.blueits.workers.dev/de/home/misc/break.html?type=jslog&url=https%3A%2F%2Fextern-sparkasse-attack.blueits.workers.dev%2Fde%2Fhome.html&stref=checkProxy&check=false&ho...

0
0

GET
H2

404

Primary Request nonexistent.html Show response
extern-sparkasse-attack.blueits.workers.dev/de/home/
Redirect Chain

https://extern-sparkasse-attack.blueits.workers.dev/content/myif/spk-amberg-sulzbach/work/filiale/de/home/nonexistent.html
https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html

703 B
646 B

3137ms
3137ms

Document
text/html

172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html
Requested by: Host: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale.min.03b4878472432518c6a5fdd244ac9783.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a682da489684c4620f4401ef49ef49d76c6a57c0752e74411d61ca046820459c

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 8bb636c2889956cb-OSL
content-encoding: br
content-type: text/html
date: Fri, 30 Aug 2024 16:38:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVFU47vnUvwebcMdaq6T3LF3ArUQd38t9Y842EufJBK%2Bp35c6T7NIUz5ZsM452b4VU61UwlcyK2f82aAwUT%2BXg%2FkHIDcD9G9CVvrK2ZnGJygo1bNbh93DKE17ZhPYwnTIY6HO%2BAgQ7WQORIlpZwRuGiqxoQnjZczvoq9S5EY"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-tlscipher: provided

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8bb636b58c1156cb-OSL
content-type: text/html; charset=iso-8859-1
date: Fri, 30 Aug 2024 16:38:53 GMT
location: https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YBEf0RctLZIaD3WD6hmgsF7P3wvOTdEIHBhOsD%2FhmSaJUyikXUcaUd1XlA9%2F9SBbk2nbfoceUC2S71ZuYo1U4TbYR0ZK85K1zPdGWPHfscgLRS7Z1Dwsb1DWje5xVe%2FktZkvBy8IvPafuDj6LpRu15W63OT5IV95pBvZuxpf"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-tlscipher: checked
x-ua-compatible: IE=edge

GET
H2 200 1683298971485.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref1.epimgref.res1920.jpg/ 153 KB
154 KB 3341ms
3340ms Image
image/jpeg 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref1.epimgref.res1920.jpg/1683298971485.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:53 GMT
strict-transport-security: max-age=31536000
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 156769
x-ua-compatible: IE=edge
last-modified: Thu, 29 Aug 2024 15:13:25 GMT
server: cloudflare
etag: "26461-620d3ea891424"
vary: User-Agent, Accept-Encoding
x-frame-options: DENY
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2B48%2F4%2BJCcHWT1TphXnMMJQ73plm7UASvVigaYcx0LKBi7QsDjtk%2FFFcLRrRCU5%2FmP%2FEd%2FJklq09NnOFBnvMaU7K1ZyViXT%2Fn0YWhoZEvXhMuVXcVydDUxdOLX00hC1EbvMZOcD%2BC14WPaSyLJCXUchnynMt72ZjKFD1oj0T"}],"group":"cf-nel","max_age":604800}
x-tlscipher: checked
accept-ranges: bytes
cf-ray: 8bb636b69d7c56cb-OSL

GET 1721654430274.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref2.epimgref.res1920.jpg/ 0
0

GET 1581584649087.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref3.epimgref.res1920.jpg/ 0
0

GET 1722490274921.jpg
extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref5.epimgref.res1920.jpg/ 0
0

GET SparkasseHead_web_Rg.ttf
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET pictos-if.ttf
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Md.ttf
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Rg.ttf
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Bd.ttf
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET Sparkasse_web_Lt.ttf
extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/ 0
0

GET
H2 200 favicon.ico
extern-sparkasse-attack.blueits.workers.dev/ 10 KB
11 KB 1512ms
1512ms Other
image/vnd.microsoft.icon 172.67.202.93
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://extern-sparkasse-attack.blueits.workers.dev/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.202.93 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0ccef5529f0f9e0e44e58fa8f1b167713e2bb5bec16bea31730d59a7f3dd108

Request headers

Referer: https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 16:38:58 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YrHmv6DYDrz%2FCQqtedbkM78cRMsiPx7EpE2QC4G4t2qlEMLPFjvGP7p3f6jhk4Oy%2BQwISXv6CJeJF3F4FXbUI7kM%2Feodpl%2BhAuXWZWbPorLdMz5JbC3ffwmr0MdsbBTTv2U%2BtGp1HxUxOnHs1JKVRFOjZDMH0eVKIKSmLrsq"}],"group":"cf-nel","max_age":604800}
content-type: image/vnd.microsoft.icon
x-tlscipher: accepted
cf-ray: 8bb636d78cb356cb-OSL
alt-svc: h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: module.sparkasse-amberg-suizbach.de
URL: https://module.sparkasse-amberg-suizbach.de/if/services/tdg?hs=fe155e220548b97fea72e01120242c94a880b0235910222186e6314065aa866d

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Rg.woff

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/pictos-if.woff

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Md.woff

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Bd.woff

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/SparkasseHead_web_Rg.woff

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Lt.woff

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home/misc/break.html?type=jslog&url=https%3A%2F%2Fextern-sparkasse-attack.blueits.workers.dev%2Fde%2Fhome.html&stref=checkProxy&check=false&hostname=extern-sparkasse-attack.blueits.workers.dev&salt=HuyE5pYcno&hash=-1148157808&proof=664330676

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref2.epimgref.res1920.jpg/1721654430274.jpg

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref3.epimgref.res1920.jpg/1581584649087.jpg

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home/_jcr_content/opener/openerref5.epimgref.res1920.jpg/1722490274921.jpg

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/SparkasseHead_web_Rg.ttf

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/pictos-if.ttf

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Md.ttf

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Rg.ttf

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Bd.ttf

Domain: extern-sparkasse-attack.blueits.workers.dev
URL: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Lt.ttf

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
extern-sparkasse-attack.blueits.workers.dev/de	1969-12-31 23:59:59	Name: TS01cb272b Value: 010bf2cd6c831177eba3fa838a50eea7bc33449bdad18f8385630d9ee184818424592026d2a251cf2eccd06b928d1d64be18ab09dd314bd65faba094eb2ce381e7fa724d3f
extern-sparkasse-attack.blueits.workers.dev/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000qk2C34UC6fHhRHw9J6Mt40Y:0773f0ef3
extern-sparkasse-attack.blueits.workers.dev/	1970-01-21 03:29:47	Name: DeviceID Value: 584dc95d-4e3e-4fa7-a341-6113bf2d4375
extern-sparkasse-attack.blueits.workers.dev/	1970-01-20 23:53:47	Name: IF_SPKDE_CHECK Value: SPKDE_CHECK
extern-sparkasse-attack.blueits.workers.dev/	1969-12-31 23:59:59	Name: TS01fda778 Value: 010bf2cd6ce11d071be227355a919fdd2c9883f951d18f8385630d9ee184818424592026d213f05412fecbf6f80b60a54146ed9c873cdbc6fc218c443f25f5237ea446836ec3ca4647a09efa11e5665c28c660ed40401f159d488307ed71668b8dd162de67f02f6f0fa11bee098fbb9dda581e284c
.sparkasse.de/	1970-01-21 03:29:47	Name: SPK_COOKIE_EXTRAS Value: YWNjdXJhY3k9aGlnaCZiYW5rY29kZT03NTI1MDAwMCZzb3VyY2U9c2VydmxldA%3D%3D
.sparkasse.de/	1970-01-21 03:29:47	Name: SPK_COOKIE Value: YmFua2NvZGU9NzUyNTAwMDA%3D

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Rg.woff
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/pictos-if.woff
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Md.woff
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Bd.woff
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/SparkasseHead_web_Rg.woff
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Lt.woff
network	error	URL: https://module.sparkasse-amberg-suizbach.de/if/services/tdg?hs=fe155e220548b97fea72e01120242c94a880b0235910222186e6314065aa866d Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/SparkasseHead_web_Rg.ttf
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/pictos-if.ttf
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Md.ttf
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Rg.ttf
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Bd.ttf
intervention	info	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://extern-sparkasse-attack.blueits.workers.dev/etc/clientlibs/myif/master/base/internetfiliale/fonts/Sparkasse_web_Lt.ttf
network	error	URL: https://extern-sparkasse-attack.blueits.workers.dev/de/home/nonexistent.html Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'self' blob: https://morris-server.de:8801 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' data: blob: https://api.sparkassen-mediacenter.de https://sparkassen-mediacenter.de https://cdn.sparkassen-mediacenter.de
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

extern-sparkasse-attack.blueits.workers.dev
module.sparkasse-amberg-suizbach.de
www.sparkasse.de
extern-sparkasse-attack.blueits.workers.dev
module.sparkasse-amberg-suizbach.de
172.67.202.93
185.85.1.81
19b5fad9a3fc6b8ffb02849e198c9bbcf4280e267d14081f3265fc69fa9ec552
21d898da796edae24c1f0365bc477c2a25a9c407d72e11a7f84830c9dd3ea51a
34a3c587d112b5a4e3f6d005367a3922cc5c740bd7e3a07db192a4b351059644
7fd8120391ed2925249baf5fb54bf0b2d9c3aec0a5f4933ab60536209dbcb05e
a0ec32bc9358eeaaf9e7ba8069871996b5f7a327b1e468ceeb6c710bde97d69b
a3e108e2717696b055411fa5b6f634d6a726cafce12e1648c3895c17dc74fd29
a682da489684c4620f4401ef49ef49d76c6a57c0752e74411d61ca046820459c
f0ccef5529f0f9e0e44e58fa8f1b167713e2bb5bec16bea31730d59a7f3dd108
f4e07d2fb57dd99f228e0d5b6e4e7a8d051ae49bb9643d850ac10369a6158e35
f817eee319405982e5d58802a785f43585945abfa18ed7824121083ede62d87b

extern-sparkasse-attack.blueits.workers.dev Open in urlscan Pro 172.67.202.93 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

35 Requests

51 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

2026 kBTransfer

5489 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

35 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

7 Cookies

14 Console Messages

Security Headers

Indicators

extern-sparkasse-attack.blueits.workers.dev Open in urlscan Pro
172.67.202.93 Public Scan

Screenshot
Live screenshot

Full Image

35
Requests

51 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2026 kB
Transfer

5489 kB
Size

7
Cookies

35 HTTP transactions
0 data transactions