www.languagede-gercustom.de Open in urlscan Pro
2606:4700:3035::ac43:dc49 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.languagede-gercustom.de/
Submission: On July 17 via api (July 17th 2022, 8:08:24 am UTC) from JP — Scanned from DE

Summary HTTP 10 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3035::ac43:dc49, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.languagede-gercustom.de.

This is the only time www.languagede-gercustom.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
10	2606:4700:303... 2606:4700:3035::ac43:dc49		13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	1

10 2606:4700:3035::ac43:dc49 (United States)

ASN13335 (CLOUDFLARENET, US)

www.languagede-gercustom.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	languagede-gercustom.de www.languagede-gercustom.de	482 KB
10	1

	Domain	Requested by
10	www.languagede-gercustom.de	www.languagede-gercustom.de
10	1

This site contains links to these domains. Also see Links.

Domain
kredit.skpk.de
web.s-investor.de
t23.intelliad.de
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
blog.berliner-sparkasse.de

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.languagede-gercustom.de/
Frame ID: BAB77271EE40E873D2A88AC90874976E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Internet-Filiale - Sparkasse

Page Statistics

10
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

482 kB
Transfer

1996 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://kredit.skpk.de/?template=Privatkredit_Berlin&utm_source=if6&utm_medium=bsk&utm_campaign=mv_pkvv_17_08&utm_content=footer
Title: S-Privatkredit

Search URL Search Domain Scan URL

URL: https://web.s-investor.de/app/markt.htm?INST_ID=0004093&ident=0
Title: BörsenCenter

Search URL Search Domain Scan URL

URL: http://t23.intelliad.de/index.php?redirect=https%3A%2F%2Fwww.berliner-sparkasse.de%2Fde%2Fhome%2Fservice%2Fnewsletter.html&cl=0383839313236323131303&bm=100&bmcl=6353835313236323131303&cp=893&ag=124&crid=108
Title: Newsletter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/berlinersparkasse
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/BerlinerSPK
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/berlinersparkasse/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/berlinersparkasse
Title: Youtube

Search URL Search Domain Scan URL

URL: http://blog.berliner-sparkasse.de/
Title: Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.languagede-gercustom.de/ 1 KB
1 KB 196ms
189ms Document
text/html 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91e2ddb27aa45076fc969c83720a61376c13512afc9a8cbfc4c2c135d16f8b9b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 72c17d32e9ce9b31-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Sun, 17 Jul 2022 08:08:19 GMT
Last-Modified: Mon, 11 Jul 2022 19:47:23 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=64vEX2bweY5UkhoBjeO%2F27%2B9IltvmAoS%2Bp2ksbPiY0o0vN%2Br%2BMSL2PMR0GBYvUWQXbH4vPMFkpIDNEiE%2BE0HX7VM%2B0j%2FRLOA3alfAGSgD%2B9%2BHpZSQzho6icBxuY2RXAY3cG492vkxupJiHUE%2F%2F6%2BSRMPLs0ZUQjbzJY%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK style.css
www.languagede-gercustom.de/css/ 1 MB
154 KB 119ms
118ms Stylesheet
text/css 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/css/style.css
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eddcb059236ed4f4f7fce2060dcfa34eae43c11edfd3f2c17a51eecb144b2f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.languagede-gercustom.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:19 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Mon, 11 Jul 2022 19:47:26 GMT
Server: cloudflare
ETag: W/"62cc7e4e-16707b"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CD01Ec89%2B1hxUxc1jT%2BlkZZFd%2BqSW95BgNLyAfL1yQEvIDMCQxqRfv0FdEcBEC%2BZ9y8zEB7XZpMDNKgGs1hRtczSeLe17XI1TPpmbJdp2cmXJ0BRFdCA9aEjPnUYIKG%2B2i48F%2BW5cBjt59yevailUNgTY4om0M3mog4%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 72c17d341b8a9b31-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK main.f174db22.js Show response
www.languagede-gercustom.de/static/js/ 316 KB
95 KB 139ms
125ms Script
application/javascript 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/static/js/main.f174db22.js
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51d7d4a518670e90951ebdff9802c8809886af641ebb9529e81dd9060bc66798

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.languagede-gercustom.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:19 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Mon, 11 Jul 2022 19:47:22 GMT
Server: cloudflare
ETag: W/"62cc7e4a-4f13a"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zymkaU8U8soaEQj0a0Ke7bwU3F3OgWL2cpuUdMrRI0KVIqcmOxjnGuw6L0htAMZrYN8L39Duymp2so7Uota97sszy0j4FbeF%2FSQCLSoftK453jEX%2FANHTUIJTfreoRjT3LC%2FVRw3yYq9qavzduYU4Fz6Llr9yV8Ot8c%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 72c17d342afc913a-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK main.f6f53d17.css
www.languagede-gercustom.de/static/css/ 4 KB
2 KB 40ms
27ms Stylesheet
text/css 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/static/css/main.f6f53d17.css
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa809558f65f4392975344302394e8c46b85a834721e5f119ef5e2b4ae6b206e

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.languagede-gercustom.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:19 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 202
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Last-Modified: Mon, 11 Jul 2022 19:47:22 GMT
Server: cloudflare
ETag: W/"62cc7e4a-e46"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2FUqvCrdUn3QRuBFw2IG%2B%2FpZhKSYJyK65QGNEIFMk5fFjj0szmWKpk%2FZO9rv09g3WdWm%2Fl4%2F3j8y8puP9mwXm%2FiCAn%2BibQVC%2BXedJt2RJwT1feHKUl6ZPDHfzgZ5NkNTzqXQPgWjxRaigtiOQ8XLag2ZuAZ2U9ZArgM%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
CF-RAY: 72c17d342c5c9165-FRA

POST
H/1.1 200
OK login Show response
www.languagede-gercustom.de/backend/phishing-api/ 146 B
1 KB 437ms
437ms XHR
application/json 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://www.languagede-gercustom.de/backend/phishing-api/login

Requested by

Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/static/js/main.f174db22.js

Protocol

HTTP/1.1

Server

2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3e1e989b096929cb8874526ccdaf160a08634828521a63b7e82653ae2c3c20b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: http://www.languagede-gercustom.de/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

Date: Sun, 17 Jul 2022 08:08:20 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: cloudflare
X-Frame-Options: DENY
Access-Control-Max-Age: 3600
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BTvz7Fw8FS5aT1EzPk4L67NxcTckAOgU%2BCu%2FS%2BKHQPzgnU%2BXpLApmpAFP9IxRDodigx2h1IO1C6cmfVM9qQpwzKH5VKPzXcJh7Wp8%2FhKsf7e12420D78hhP3aHM8x1SSDI51Nu9EguFewoDnsJT6KJKNMmnr%2FezWcNE%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: xsrf-token
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
CF-RAY: 72c17d355d14913a-FRA
Access-Control-Allow-Headers: authorization, content-type, xsrf-token, X-TenantID, Payment-Code
Expires: 0

GET
H/1.1 200
OK spk-logo.e094517258e696592c79a6d2e65c4e55.svg
www.languagede-gercustom.de/static/media/ 22 KB
9 KB 143ms
142ms Image
image/svg+xml 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.languagede-gercustom.de/static/media/spk-logo.e094517258e696592c79a6d2e65c4e55.svg
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 484992c25ce8dc0d0b2b0a0f11b6de4ea5e158c4762497497b007476e0c721d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.languagede-gercustom.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:20 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Mon, 11 Jul 2022 19:47:17 GMT
Server: cloudflare
ETag: W/"62cc7e45-58e2"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BtSHJ1OX50Y5v50DrsT9PbEMuxtTCrCQeN9x%2F8IXBxiAXTGgk7Vzx2uOtsDisSFFntPCU1Rta1dQ9S0yjiZDJd9Y9xXyhC1cpB6RazIVNQQHf%2BjeThYv%2FMMSIcasJzYEdMwvHZtZOxlWedZSEDp8Z%2F05HvFNWt82nmU%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/svg+xml
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 72c17d357d2d9b31-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK search.f3632f79a9da4aeb24e0.svg
www.languagede-gercustom.de/static/media/ 484 B
1 KB 28ms
28ms Image
image/svg+xml 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.languagede-gercustom.de/static/media/search.f3632f79a9da4aeb24e0.svg
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/static/css/main.f6f53d17.css
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2805c3dfeb6ca4c6e35ee20edf47c6f6359dd1ec797ccc5ca04ca566d68fc95c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.languagede-gercustom.de/static/css/main.f6f53d17.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:20 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 203
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Last-Modified: Mon, 11 Jul 2022 19:47:18 GMT
Server: cloudflare
ETag: W/"62cc7e46-1e4"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HVEk3CHXTUtoTIEdSqT8bsA%2F6CW%2FpA%2BO0HynUCub1rSCeZO9fz2%2BGwtCm1f6Zbdpm6PXvOlMjPi2joWVjqM4n3%2Bd2Ch1vdeAXrSCvrQINg9bzqsGVNMY1ZaDVVYa0mouTJV%2B1VBTXjFrBS5LHbnMQ2Y%2F29UeR1Hy3gA%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/svg+xml
Cache-Control: max-age=14400
CF-RAY: 72c17d357e719165-FRA

GET
H/1.1 200
OK Sparkasse_web_Rg.woff
www.languagede-gercustom.de/fonts/ 41 KB
41 KB 172ms
159ms Font
application/font-woff 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/fonts/Sparkasse_web_Rg.woff
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/css/style.css
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451

Request headers

Referer: http://www.languagede-gercustom.de/css/style.css
Origin: http://www.languagede-gercustom.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:20 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Mon, 11 Jul 2022 19:47:26 GMT
Server: cloudflare
ETag: W/"62cc7e4e-a200"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sd%2F%2FnZ1nuJ%2FFQ3AUBqsqn6TUBpG6KbnrrvdooVjC6tg9H56lyenlSDc%2BeWWQkRVkZHNTsZ%2Bc3YUZ0gD3Qv2kFNW064eSsMmr4SM887xkZZu9SEi%2BzZl0B9iyArNACh4YmzYxL2%2BRRuMmGVht7WKzAR0VrwLrrzlejLU%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/font-woff
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 72c17d359f9c9b25-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK pictos-if.woff
www.languagede-gercustom.de/fonts/ 139 KB
140 KB 140ms
127ms Font
application/font-woff 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/fonts/pictos-if.woff
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/css/style.css
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84798913afc7420e1087ff7c0a0c5b39937ddd430b67bf96561ffbaed9e77b14

Request headers

Referer: http://www.languagede-gercustom.de/css/style.css
Origin: http://www.languagede-gercustom.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:20 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Mon, 11 Jul 2022 19:47:27 GMT
Server: cloudflare
ETag: W/"62cc7e4f-22d74"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBcVJdyuII1%2FhCQ4CZeKIU8Sh6DKygCuyxVPPqKxhg0J4scoPbiGRWwvrJHtm3dJc3dIoB0Z00hjH06gIoYItnC37uZrKauFDnaiOmbSPhf2Q0mPdRizQizdAN7aD6j7P9el3v8rJAfumCK4kVr765smic2yIVwIjXc%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/font-woff
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 72c17d359bf4bbd7-FRA
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}

GET
H/1.1 200
OK Sparkasse_web_Bd.woff
www.languagede-gercustom.de/fonts/ 36 KB
37 KB 39ms
26ms Font
application/font-woff 2606:4700:3035::ac43:dc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.languagede-gercustom.de/fonts/Sparkasse_web_Bd.woff
Requested by: Host: www.languagede-gercustom.de
URL: http://www.languagede-gercustom.de/css/style.css
Protocol: HTTP/1.1
Server: 2606:4700:3035::ac43:dc49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002

Request headers

Referer: http://www.languagede-gercustom.de/css/style.css
Origin: http://www.languagede-gercustom.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Sun, 17 Jul 2022 08:08:20 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 203
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Last-Modified: Mon, 11 Jul 2022 19:47:26 GMT
Server: cloudflare
ETag: W/"62cc7e4e-901c"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DC0o9FJ%2BGDTAsuaNDSR10URSIQRuv6b3WKBYkv2lzCw4TdtevKiQzC31ko%2F7xRI7S%2FpcvOIvxZTOUj%2Fm%2FRCh74A1Odr%2FVWMq5pD7Zj1QFqZkNbmJB98xSJozVXXAZgok1U7%2FScpNed3evYF%2Baxa2B36t9ECrsMjF03M%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/font-woff
Cache-Control: max-age=14400
CF-RAY: 72c17d359b4e9060-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.languagede-gercustom.de
2606:4700:3035::ac43:dc49
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451
2805c3dfeb6ca4c6e35ee20edf47c6f6359dd1ec797ccc5ca04ca566d68fc95c
484992c25ce8dc0d0b2b0a0f11b6de4ea5e158c4762497497b007476e0c721d8
51d7d4a518670e90951ebdff9802c8809886af641ebb9529e81dd9060bc66798
84798913afc7420e1087ff7c0a0c5b39937ddd430b67bf96561ffbaed9e77b14
91e2ddb27aa45076fc969c83720a61376c13512afc9a8cbfc4c2c135d16f8b9b
9eddcb059236ed4f4f7fce2060dcfa34eae43c11edfd3f2c17a51eecb144b2f2
aa809558f65f4392975344302394e8c46b85a834721e5f119ef5e2b4ae6b206e
d3e1e989b096929cb8874526ccdaf160a08634828521a63b7e82653ae2c3c20b
e9b9f03e1a75cf22118a30e0503f346e8efb6859276d418e7d1a9a07f73f7002

www.languagede-gercustom.de Open in urlscan Pro 2606:4700:3035::ac43:dc49 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

482 kBTransfer

1996 kBSize

0 Cookies

8 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

www.languagede-gercustom.de Open in urlscan Pro
2606:4700:3035::ac43:dc49 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

482 kB
Transfer

1996 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!