Submitted URL: https://maubeuge-shopping.com/assets/
Effective URL: https://dkb-ag.engnr.in/wella/
Submission: On June 29 via manual from DE — Scanned from FR

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 9 HTTP transactions. The main IP is 172.105.52.9, located in Mumbai, India and belongs to LINODE-AP Linode, LLC, US. The main domain is dkb-ag.engnr.in.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 27th 2022. Valid for: 3 months.
This is the only time dkb-ag.engnr.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 213.186.33.16 16276 (OVH)
6 172.105.52.9 63949 (LINODE-AP...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
9 3
Apex Domain
Subdomains
Transfer
6 engnr.in
dkb-ag.engnr.in
143 KB
2 fontawesome.com
pro.fontawesome.com — Cisco Umbrella Rank: 6823
150 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 429
26 KB
1 maubeuge-shopping.com
maubeuge-shopping.com
121 B
9 4
Domain Requested by
6 dkb-ag.engnr.in dkb-ag.engnr.in
2 pro.fontawesome.com dkb-ag.engnr.in
pro.fontawesome.com
1 cdn.jsdelivr.net dkb-ag.engnr.in
1 maubeuge-shopping.com 1 redirects
9 4

This site contains no links.

Subject Issuer Validity Valid
dkb-ag.engnr.in
cPanel, Inc. Certification Authority
2022-06-27 -
2022-09-25
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-02 -
2023-06-01
a year crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1
2021-12-01 -
2023-01-01
a year crt.sh

This page contains 1 frames:

Primary Page: https://dkb-ag.engnr.in/wella/
Frame ID: 1897EA16FF842666714BF6DECE24F5E5
Requests: 9 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://maubeuge-shopping.com/assets/ HTTP 301
    https://dkb-ag.engnr.in/wella/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

319 kB
Transfer

588 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://maubeuge-shopping.com/assets/ HTTP 301
    https://dkb-ag.engnr.in/wella/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dkb-ag.engnr.in/wella/
Redirect Chain
  • https://maubeuge-shopping.com/assets/
  • https://dkb-ag.engnr.in/wella/
18 KB
4 KB
Document
General
Full URL
https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.105.52.9 Mumbai, India, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2059-9.members.linode.com
Software
Apache /
Resource Hash
77e04a1fe76f9430622575d1d15e9c045fd97eae73f5cca7fb2d3602851ad884

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 29 Jun 2022 14:46:26 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Wed, 29 Jun 2022 14:46:24 GMT
location
https://dkb-ag.engnr.in/wella/
server
Apache
x-powered-by
PHP/5.6
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/css/
159 KB
26 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.1.1/dist/css/bootstrap.min.css
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://dkb-ag.engnr.in/
Origin
https://dkb-ag.engnr.in
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
8659481
x-jsd-version
5.1.1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19129-FRA, cache-cdg20783-CDG
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"27bcc-BZIWlzlsFSRVBPxM7BbsU0yOz/8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rhoTCO5yrB8C4F7UL1l9p7yx65gKAspyT%2BPfFxsXuuGXZmWZz6s6KkFEZudQEwMkWxijVL9q2KMknQesIvHGjQwX7jBVT4ODloSMEFe1cWnORZpsMSWQQDNSLgycOq3f7BSEUTKbu61z0F4Ewm8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
722f73a33bc999ae-CDG
all.css
pro.fontawesome.com/releases/v5.10.0/css/
153 KB
29 KB
Stylesheet
General
Full URL
https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec

Request headers

Referer
https://dkb-ag.engnr.in/
Origin
https://dkb-ag.engnr.in
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
age
6105
x-amz-request-id
3Z2467KZX0JAQJYB
x-amz-id-2
D26CTiavhrHBy3Ef5uCUmXDstazGnHJi0GdKPpFuSwnxKy0tfOd8ppQQCLQj7dVVWdY5Bs2OTfI=
last-modified
Mon, 28 Jun 2021 16:54:32 GMT
server
cloudflare
etag
W/"aa1272633e7e552395d147a499bad186"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
722f73a34d5c99f7-CDG
main.css
dkb-ag.engnr.in/wella/style/
7 KB
7 KB
Stylesheet
General
Full URL
https://dkb-ag.engnr.in/wella/style/main.css
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.105.52.9 Mumbai, India, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2059-9.members.linode.com
Software
Apache /
Resource Hash
516b8c6244cd8970cadf4941417cc05b363c57aa2a01fb470891f2c9e9d9578e

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dkb-ag.engnr.in/wella/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
last-modified
Thu, 23 Sep 2021 19:19:48 GMT
server
Apache
accept-ranges
bytes
etag
"1400074-1c0d-5ccae839c7d00"
content-length
7181
content-type
text/css
logo.svg
dkb-ag.engnr.in/wella/assets/
3 KB
3 KB
Image
General
Full URL
https://dkb-ag.engnr.in/wella/assets/logo.svg
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.105.52.9 Mumbai, India, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2059-9.members.linode.com
Software
Apache /
Resource Hash
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dkb-ag.engnr.in/wella/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
last-modified
Wed, 22 Sep 2021 14:44:44 GMT
server
Apache
accept-ranges
bytes
etag
"140005d-be2-5cc968e0e0f00"
content-length
3042
content-type
image/svg+xml
image2.jpg
dkb-ag.engnr.in/wella/assets/
12 KB
12 KB
Image
General
Full URL
https://dkb-ag.engnr.in/wella/assets/image2.jpg
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.105.52.9 Mumbai, India, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2059-9.members.linode.com
Software
Apache /
Resource Hash
de763dedf5fbf5a7f0a42ca06cccba4f37f85a35a4bcb378ad5ae886c884bfcd

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dkb-ag.engnr.in/wella/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
last-modified
Thu, 23 Sep 2021 05:27:18 GMT
server
Apache
accept-ranges
bytes
etag
"1400054-301d-5cca2e25bf980"
content-length
12317
content-type
image/jpeg
image3.jpg
dkb-ag.engnr.in/wella/assets/
29 KB
29 KB
Image
General
Full URL
https://dkb-ag.engnr.in/wella/assets/image3.jpg
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.105.52.9 Mumbai, India, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2059-9.members.linode.com
Software
Apache /
Resource Hash
5408d9f3668d380c3148ecc04f9401c082f980a88d86962bc906baf0d7abdb28

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dkb-ag.engnr.in/wella/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
last-modified
Thu, 23 Sep 2021 05:30:18 GMT
server
Apache
accept-ranges
bytes
etag
"1400059-7218-5cca2ed168e80"
content-length
29208
content-type
image/jpeg
jquery.js
dkb-ag.engnr.in/wella/plugin/
87 KB
88 KB
Script
General
Full URL
https://dkb-ag.engnr.in/wella/plugin/jquery.js
Requested by
Host: dkb-ag.engnr.in
URL: https://dkb-ag.engnr.in/wella/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.105.52.9 Mumbai, India, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2059-9.members.linode.com
Software
Apache /
Resource Hash
80f04717f32ea0320c5e8618fbacedd1fee3a8775ad8292140a6113551d4b5b0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dkb-ag.engnr.in/wella/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
last-modified
Wed, 22 Sep 2021 14:29:20 GMT
server
Apache
accept-ranges
bytes
etag
"1400070-15d9c-5cc9656faf000"
content-length
89500
content-type
application/javascript
fa-solid-900.woff2
pro.fontawesome.com/releases/v5.10.0/webfonts/
120 KB
120 KB
Font
General
Full URL
https://pro.fontawesome.com/releases/v5.10.0/webfonts/fa-solid-900.woff2
Requested by
Host: pro.fontawesome.com
URL: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d27aa8bf9677cf4ef12acd7b37afc20f1f661d7c163b929ae9caf103b01fce37

Request headers

Referer
https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Origin
https://dkb-ag.engnr.in
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 29 Jun 2022 14:46:27 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
age
6104
cf-ray
722f73a3debb99f7-CDG
content-length
123004
x-amz-id-2
Se7zlLyLE+ipaumusucPeS8Id+aPtbUSfz3PGowhpupvWYxtggVnouM43AxlZC5IHLi7YXiy6/w=
last-modified
Mon, 28 Jun 2021 16:56:06 GMT
server
cloudflare
etag
"88fd444847dc842d15e229df26571b03"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-request-id
KBEPBECHYWD6TGVR
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
content-type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DKB (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Domain/Path Name / Value
dkb-ag.engnr.in/ Name: numberVictime
Value: 576944