www.sidentityupdate.at
Open in
urlscan Pro
2a01:aee0:0:11::11
Malicious Activity!
Public Scan
Submission: On December 30 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on December 28th 2022. Valid for: 3 months.
This is the only time www.sidentityupdate.at was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 2a01:aee0:0:1... 2a01:aee0:0:11::11 | 208582 (EASYNAME) (EASYNAME) | |
2 | 213.150.6.28 213.150.6.28 | 12895 (IT-AUSTRI...) (IT-AUSTRIA Vienna) | |
14 | 3 |
ASN12895 (IT-AUSTRIA Vienna, Austria, AT)
PTR: login.sparkasse.at
login.sparkasse.at |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
sidentityupdate.at
www.sidentityupdate.at |
164 KB |
2 |
sparkasse.at
login.sparkasse.at |
2 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
14 | 3 |
Domain | Requested by | |
---|---|---|
11 | www.sidentityupdate.at |
www.sidentityupdate.at
|
2 | login.sparkasse.at |
www.sidentityupdate.at
|
0 | nlbmnnijcnlegkjjpcfjclmcfggfefdm Failed |
www.sidentityupdate.at
|
14 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sparkasse.at |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.sidentityupdate.at R3 |
2022-12-28 - 2023-03-28 |
3 months | crt.sh |
login.sparkasse.at DigiCert SHA2 Extended Validation Server CA |
2022-03-16 - 2023-04-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.sidentityupdate.at/file/pass.php
Frame ID: 543D11F1664926D9862B20F4E7BC5BB7
Requests: 16 HTTP requests in this frame
6 Outgoing links
These are links going to different origins than the main page.
Title: here
Search URL Search Domain Scan URL
Title: Imprint
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Terms & Conditions
Search URL Search Domain Scan URL
Title: Contact & Services
Search URL Search Domain Scan URL
Title: Already using s Identity-App and need a new activation code?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
pass.php
www.sidentityupdate.at/file/ |
424 KB 148 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lib.css
www.sidentityupdate.at/sts/styles/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gWqvRrszL2yz5NLdR4kW.js
www.sidentityupdate.at/sts/7hSTR7CfYN/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Doppel-Logo_o_Claim.svg
www.sidentityupdate.at/file/sts/images/logos/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
George-symbol.svg
www.sidentityupdate.at/file/sts/images/clients/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bankcard.gif
www.sidentityupdate.at/sts/images/ |
5 KB 5 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
cxWeb3.js
nlbmnnijcnlegkjjpcfjclmcfggfefdm/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
900 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Semibold-webfont.woff
www.sidentityupdate.at/file/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Regular-webfont.woff
www.sidentityupdate.at/file/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Doppel-Logo_o_Claim.svg
www.sidentityupdate.at/sts/images/logos/ |
5 KB 5 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Regular-webfont.ttf
www.sidentityupdate.at/file/OpenSans/webfonts/opensans_regular/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OpenSans-Semibold-webfont.ttf
www.sidentityupdate.at/file/OpenSans/webfonts/opensans_semibold/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
96 B 1019 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
JjVL1xJVDS
login.sparkasse.at/sts/ |
60 B 993 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- nlbmnnijcnlegkjjpcfjclmcfggfefdm
- URL
- chrome-extension://nlbmnnijcnlegkjjpcfjclmcfggfefdm/js/cxWeb3.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| keepalive function| setupKeepaliveInterval number| FLIP_ICON_HEIGHT undefined| myWindow function| sumNumbers function| doRwd function| removeEmptyIEAlertPadding function| calcCol2Height function| calcVisibleWhiteboxHeight function| centerpage function| confirmmsg function| windowtracker function| $ function| jQuery string| extensionID object| reWhiteSpace function| Utf8Encode function| htmlToJsConversion function| nbalert function| setFldFocus function| isWhiteSpace function| isEmpty function| doDisableSpecifiedForm function| doSubmitAndDisable function| jsxEncrypt function| encodeToHex object| STS object| STSSecAppSecondfactor function| setFocus function| displayError function| checkUser function| submitCredentials function| submitCancelLoginForm object| STSCookieBanner boolean| ajax_disabled object| webinject_config string| eventObf function| cls undefined| unload_backup_handler object| w2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.sidentityupdate.at/ | Name: 4G0qy9fDDI Value: QjzG5YBaUKGS6JGZ2FW7NmLqZ6uqp5qF |
|
www.sidentityupdate.at/ | Name: NHIJACZdcO Value: rIlNHbKSGqkDYULTnze5sLqjcK9VYo5X |
56 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15768000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.sparkasse.at
nlbmnnijcnlegkjjpcfjclmcfggfefdm
www.sidentityupdate.at
nlbmnnijcnlegkjjpcfjclmcfggfefdm
213.150.6.28
2a01:aee0:0:11::11
04cf169a10f64a9ce6b5650e37e047651690b18b238e1f431636aa292d6fb600
315038a6407b30a3dcfcd6748b3c323c31f49156806decbdf7c2d7ba2111b1f5
48c24fd8fb19b02949a64918eb768e58dbe70210ad7de1f7f78dfc0052dfde82
4bdabb62bda560c12583237d1546cfbec8bf0968c40c6cd1545d6e107f8ae26d
9f7f3614601cb973b0e9d62deeb48c1c6a1bb178450402062c726c177d5fc03f
ac46b34d79ab1942b00cfcf903cf75e0e2ed9f354ed493a2cf7d5fa0d85c569b
b8bb52fdbcbdc0b034daee432a3eb2f3232cb0ba16a3eb527bae55cdbc4aaa96
fd522f13a5aae296abb8ff38035620d685088fa0d006363c11ffcfbdb549a8c4