wallapop-paying.xyz Open in urlscan Pro
193.233.48.27  Malicious Activity! Public Scan

URL: https://wallapop-paying.xyz/anmelden
Submission: On September 21 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 193.233.48.27, located in Russian Federation and belongs to SERVER4-AS, RU. The main domain is wallapop-paying.xyz.
TLS certificate: Issued by R3 on September 14th 2022. Valid for: 3 months.
This is the only time wallapop-paying.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BW-Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
12 193.233.48.27 210352 (SERVER4-AS)
12 1
Apex Domain
Subdomains
Transfer
12 wallapop-paying.xyz
wallapop-paying.xyz
1 MB
12 1
Domain Requested by
12 wallapop-paying.xyz wallapop-paying.xyz
12 1
Subject Issuer Validity Valid
bw-informationen.de
R3
2022-09-14 -
2022-12-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://wallapop-paying.xyz/anmelden
Frame ID: 9FA957FCAACEA09E3F2343339BDBB081
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Login Online-Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div class="[^"]*parbase

Overall confidence: 100%
Detected patterns

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1129 kB
Transfer

3979 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request anmelden
wallapop-paying.xyz/
99 KB
10 KB
Document
General
Full URL
https://wallapop-paying.xyz/anmelden
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
22715b98e8dd6a55578bb79b81c7b2bf3a2d42cfe64cff73d238a913e4133c09

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, private
Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 21 Sep 2022 12:58:56 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.52 (Ubuntu)
Transfer-Encoding
chunked
Vary
Accept-Encoding
style.css
wallapop-paying.xyz/
2 MB
208 KB
Stylesheet
General
Full URL
https://wallapop-paying.xyz/style.css
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/anmelden
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
73361ae6cded8de9b27124b5a7c5af7cd8034488a8306f43da6ae493172c68d4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wallapop-paying.xyz/anmelden
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Content-Encoding
gzip
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"217e44-5e90f5b927a94-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
script.js
wallapop-paying.xyz/
1007 KB
179 KB
Script
General
Full URL
https://wallapop-paying.xyz/script.js
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/anmelden
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
b3269f873f887adc0544a5160104f85dd1585379e241a571a5b35262be9933fc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wallapop-paying.xyz/anmelden
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Content-Encoding
gzip
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"fbb80-5e90f5b926af4-gzip"
Vary
Accept-Encoding
Content-Type
text/javascript
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
bwbank-logo-desktop.png
wallapop-paying.xyz/img/
5 KB
5 KB
Image
General
Full URL
https://wallapop-paying.xyz/img/bwbank-logo-desktop.png
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/anmelden
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
03e63f29a1ac9664f6ed1c78b1e0264115327a2aa2db9dd5ec7872ba49bbc007

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wallapop-paying.xyz/anmelden
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"141b-5e90f5b926af4"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5147
bwbank-logo-mobile.png
wallapop-paying.xyz/img/
5 KB
5 KB
Image
General
Full URL
https://wallapop-paying.xyz/img/bwbank-logo-mobile.png
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/anmelden
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
5ecccf37d99d0cbd61e5548e217634997101d018c10ee50e53a392e67b0aea7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wallapop-paying.xyz/anmelden
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"1352-5e90f5b926af4"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4946
bwbank-logo-druck.png
wallapop-paying.xyz/img/
15 KB
16 KB
Image
General
Full URL
https://wallapop-paying.xyz/img/bwbank-logo-druck.png
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/anmelden
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
bd964f3665059fcb06470f662f2e18b623d37d0d475a0150aa64297479abf408

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wallapop-paying.xyz/anmelden
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"3d32-5e90f5b926af4"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
15666
Sparkasse_web_Rg.woff
wallapop-paying.xyz/
54 KB
54 KB
Font
General
Full URL
https://wallapop-paying.xyz/Sparkasse_web_Rg.woff
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
823d3082ee96fe43ce4575358ad5669582f588d4c4bed640144bcbcdf6c6a3d1

Request headers

Referer
https://wallapop-paying.xyz/style.css
Origin
https://wallapop-paying.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"d800-5e90f5b928a34"
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
55296
pictos-if.woff
wallapop-paying.xyz/
272 KB
272 KB
Font
General
Full URL
https://wallapop-paying.xyz/pictos-if.woff
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
b12bb4ece9d8cda71dc0cdf4835b68205466150ff0c196732066c1be2246ad13

Request headers

Referer
https://wallapop-paying.xyz/style.css
Origin
https://wallapop-paying.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"440d0-5e90f5b928a34"
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
278736
Sparkasse_web_Bd.woff
wallapop-paying.xyz/
48 KB
48 KB
Font
General
Full URL
https://wallapop-paying.xyz/Sparkasse_web_Bd.woff
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
a806b740fefbd69178cf16122d2ea7512f847de2f0ba1671041edc4a4ee8205a

Request headers

Referer
https://wallapop-paying.xyz/style.css
Origin
https://wallapop-paying.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"c028-5e90f5b926af4"
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
49192
Sparkasse_web_Rg.ttf
wallapop-paying.xyz/
68 KB
68 KB
Font
General
Full URL
https://wallapop-paying.xyz/Sparkasse_web_Rg.ttf
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
870690dc50dced95a6113958a87976718617a8f961cb5876c06f24831db6f659

Request headers

Referer
https://wallapop-paying.xyz/style.css
Origin
https://wallapop-paying.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"10ef8-5e90f5b926af4"
Content-Type
font/ttf
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
69368
Sparkasse_web_Bd.ttf
wallapop-paying.xyz/
58 KB
59 KB
Font
General
Full URL
https://wallapop-paying.xyz/Sparkasse_web_Bd.ttf
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
98912c98211f9b7ef0f476283615194f1b730587d79f49a3e5cafde5545ebf93

Request headers

Referer
https://wallapop-paying.xyz/style.css
Origin
https://wallapop-paying.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:56 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"e924-5e90f5b927a94"
Content-Type
font/ttf
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
59684
pictos-if.ttf
wallapop-paying.xyz/
204 KB
204 KB
Font
General
Full URL
https://wallapop-paying.xyz/pictos-if.ttf
Requested by
Host: wallapop-paying.xyz
URL: https://wallapop-paying.xyz/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
193.233.48.27 , Russian Federation, ASN210352 (SERVER4-AS, RU),
Reverse DNS
Software
Apache/2.4.52 (Ubuntu) /
Resource Hash
553a2b5c58d2bab881cfa509f5aa4f1ed5a034e4de67c5fb2f2120868a4b3c85

Request headers

Referer
https://wallapop-paying.xyz/style.css
Origin
https://wallapop-paying.xyz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Wed, 21 Sep 2022 12:58:57 GMT
Last-Modified
Mon, 19 Sep 2022 22:37:33 GMT
Server
Apache/2.4.52 (Ubuntu)
ETag
"33050-5e90f5b928a34"
Content-Type
font/ttf
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
208976

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BW-Bank (Banking)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| IF6 function| getQueryParamValue string| IF6_lightbox_closeicon_text function| overlayShow function| overlayClose function| setSessionTimeout function| focusBankingFormularElement function| toggleClassInRows function| SLURI function| moveBContent object| ifLoginHeaderTimer function| refreshClientTimeout function| refreshServerTimeout undefined| startCountdownLayer function| showCountdownLayer function| updateHeaderLoginIfPresent function| tick function| countdownShow function| callBreakHtml object| nbfDatePicker object| nbfTanInput function| selectListBoxItem function| editTeaserRef function| pagenav_statistics_send function| pagenav_statistics function| pagenav_scroll function| pagenav_scroll_window function| $ function| jQuery object| myif object| elements boolean| bcarouselAttached boolean| mkp_switcher

2 Cookies

Domain/Path Name / Value
wallapop-paying.xyz/ Name: XSRF-TOKEN
Value: eyJpdiI6InZKclVxSFd5cTZTZjFFaGpKQUF3d0E9PSIsInZhbHVlIjoiZk9rdkJrbGRBZy9pMjB3RzhRL1R4K2RlUXFENlFjZTBqa25SOG5BSkg1N0YySTBoaE5vcFJkbzA3U0toRGpvL1VOdUR0VUhCZHZZRFhaQnNhd3paeXd5eTlpUTQvZklmUVJyRERiY01aYW1mbS96enQzSS93NFMxalBQSkpOS28iLCJtYWMiOiJiYzU3MTg5MzQxMmI2MWNjM2ZlNzM1MjZjNGU2OTQ5N2JkZDkzOTNiMTlmOGYxOWU1YzVhOTliYmJjYmU4OGM4IiwidGFnIjoiIn0%3D
wallapop-paying.xyz/ Name: laravel_session
Value: eyJpdiI6IlNyMFhFNUE3ZjZCQ2lyWXBGM2N3aVE9PSIsInZhbHVlIjoiaHFreXloRDFmMFhvVzZ5TllUaHdIaVBNL1lJb0VJRWx5M1hvbGlFeWVRZTAyTnJma2Y3aGl6Z1dVQlRMeU9rV2tGclNEU1haOWhiWlI4bW81UTJnVVBOcUdJTVNzdGlZU2ppQkYvanpqSDVobXRJUDI5ZE5iRWV1bmpYQkJlL3IiLCJtYWMiOiJlY2M3YWFjNjNlNDhjYjQ0NTIwNDUyMWQ0ZTRmNGY0MjVjZjU5YmFkZjNiNjIyNTg3MWYwOTlkZTJlOTIzMzJlIiwidGFnIjoiIn0%3D

6 Console Messages

Source Level URL
Text
other warning URL: https://wallapop-paying.xyz/anmelden
Message:
Failed to decode downloaded font: https://wallapop-paying.xyz/Sparkasse_web_Rg.woff
other warning URL: https://wallapop-paying.xyz/anmelden
Message:
OTS parsing error: invalid sfntVersion: 1680881991
other warning URL: https://wallapop-paying.xyz/anmelden
Message:
Failed to decode downloaded font: https://wallapop-paying.xyz/Sparkasse_web_Bd.woff
other warning URL: https://wallapop-paying.xyz/anmelden
Message:
OTS parsing error: invalid sfntVersion: 1680881991
other warning URL: https://wallapop-paying.xyz/anmelden
Message:
Failed to decode downloaded font: https://wallapop-paying.xyz/pictos-if.woff
other warning URL: https://wallapop-paying.xyz/anmelden
Message:
OTS parsing error: invalid sfntVersion: 1680881991