ab005363c00878976e4id6.logo-in-garn.de Open in urlscan Pro
2606:4700:3032::6815:2d8  Malicious Activity! Public Scan

Submitted URL: https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv
Effective URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Submission: On April 18 via manual from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3032::6815:2d8, located in United States and belongs to CLOUDFLARENET, US. The main domain is ab005363c00878976e4id6.logo-in-garn.de.
TLS certificate: Issued by GTS CA 1P5 on April 16th 2023. Valid for: 3 months.
This is the only time ab005363c00878976e4id6.logo-in-garn.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
3 4 2606:4700:303... 13335 (CLOUDFLAR...)
4 16 2606:4700:303... 13335 (CLOUDFLAR...)
13 2
Apex Domain
Subdomains
Transfer
16 logo-in-garn.de
ab005363c00878976e4id6.logo-in-garn.de
2 MB
4 iqpak.de
bab6705534c46a9d8494b067eb40fbcf.iqpak.de
2 KB
13 2
Domain Requested by
16 ab005363c00878976e4id6.logo-in-garn.de 4 redirects bab6705534c46a9d8494b067eb40fbcf.iqpak.de
ab005363c00878976e4id6.logo-in-garn.de
4 bab6705534c46a9d8494b067eb40fbcf.iqpak.de 3 redirects
13 2

This site contains no links.

Subject Issuer Validity Valid
*.iqpak.de
GTS CA 1P5
2023-03-29 -
2023-06-27
3 months crt.sh
logo-in-garn.de
GTS CA 1P5
2023-04-16 -
2023-07-15
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Frame ID: D4D31834F8D6786333BAD0F739547DAE
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Login

Page URL History Show full URLs

  1. https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv HTTP 301
    http://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/ HTTP 301
    https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/ HTTP 302
    https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php Page URL
  2. https://ab005363c00878976e4id6.logo-in-garn.de/pst/ HTTP 302
    https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f HTTP 301
    https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/ Page URL
  3. https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients HTTP 301
    https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

92 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1549 kB
Transfer

1882 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv HTTP 301
    http://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/ HTTP 301
    https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/ HTTP 302
    https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php Page URL
  2. https://ab005363c00878976e4id6.logo-in-garn.de/pst/ HTTP 302
    https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f HTTP 301
    https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/ Page URL
  3. https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients HTTP 301
    https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv HTTP 301
  • http://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/ HTTP 301
  • https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/ HTTP 302
  • https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php
Request Chain 1
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/ HTTP 302
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f HTTP 301
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
Request Chain 7
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/js/popper.min.js HTTP 302
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/index.php?redirection=

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
indexx.php
bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/
Redirect Chain
  • https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv
  • http://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/
  • https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/
  • https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php
129 B
636 B
Document
General
Full URL
https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:8ac6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.1.18RC1
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b9cbe5c4e689277-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mLljByJTnQ1nEu4zsPdy5lvHODY12FY49R%2FMjVjUtrw2%2FTT89h2APEBFxKZScvbh5Qw8WWtMtrKQpMAcF8fCfRYO%2BbkAd7vqKjUyi2qK%2B2CMdalFCJaP7bSqlrcjdlYFdmlSNAkWggF2OARD8hrnMAZQg37srK4Gt1k22isYVRyyhlE7ByCzxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/8.1.18RC1

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b9cbe587e759048-FRA
content-type
text/html; charset=UTF-8
date
Tue, 18 Apr 2023 11:59:46 GMT
location
indexx.php
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LrG79gZN8W5jQo9sSnbx1qm2NC0lHSlU238ndOyh4PsjxLouymHKwFvbNsbt28hPXdKccudCgEy6CxgqrZOnLcC837SClQl2Tv321lIRWnfvH3pvm45wU0oo9fkpLI5AFJw7U9NwHv8k9JErE5lOpCGDB3aUAgbQRBbRe5HLMaSAYiYLoc4ptA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.1.18RC1
/
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
Redirect Chain
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
151 B
647 B
Document
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
Requested by
Host: bab6705534c46a9d8494b067eb40fbcf.iqpak.de
URL: https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.0.28 PleskLin
Resource Hash

Request headers

Referer
https://bab6705534c46a9d8494b067eb40fbcf.iqpak.de/dv/indexx.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b9cbe633f3e2bea-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BzAvWrNouUFD%2FJSSXkqU9bfmPbriiq%2FzoLBs%2BgsMiHPcBcyzxrzQh5qge5f2PWFy65Zess7dZmbpvEyNlWSeyuI0nyP5EFB4NAg%2BXwnovNNmc1mEcw5ziLSGSNfBsqyYNL0Y6qsvXIObqTEjjjy26cdJMWeoZnLIB85JOs4DhbbT8C90Rw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.0.28 PleskLin

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b9cbe62f9ea3aa3-FRA
content-type
text/html; charset=iso-8859-1
date
Tue, 18 Apr 2023 11:59:47 GMT
location
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b9%2B99ap%2FRya8i7xrVgSzDdxRIuWRKo5CEZlMCl3Pke3mx0zCtQLrbHX8HGLqPhiPPRX4jn4P41b7JcpfeQ73yi98DpAK8NzmBNJSZULOYa7xDguXEF8EFTZnO59boEkJrPF1TLz1iTIViklQS2EJ2aPEiBfRXebUrhkxdLxPBAzKJ%2Fe30Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PleskLin
Primary Request /
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Redirect Chain
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
1 KB
1 KB
Document
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.0.28 PleskLin
Resource Hash
17e3aef8ea7ce8da06a44d59724748c6b9e389942a0c581bd82a45dad7f0f41e

Request headers

Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7b9cbe6438952bea-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 18 Apr 2023 11:59:47 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SZhhLIsO1i4%2B3or2gYlTBdgjY1xRRx%2BzB0MnAH272ygzAKUxPSPN6VrAm06wRs8VKCIWX7TygtJ2aQhJ4ZJa7qBmhrJCvS4H1wnkSA1XRQ16Yk7nKj3mDs1cgRcVRL0rPoP60dXMDNSiRz99ufqBWmJF33wwV5lZ35MrAAt49%2F%2FGeqwXWA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.0.28 PleskLin

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b9cbe63e83c2bea-FRA
content-type
text/html; charset=iso-8859-1
date
Tue, 18 Apr 2023 11:59:47 GMT
location
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RTIurFZHo%2BWnakOnsngE4mXn%2B46gNKYSc82ajDacfK0vRJKt6Xb2OJseAysbGExa%2BXwWsJq5tSIZft3NRHHm2%2FyTNc5%2BBWhkWbmuBi14YBkc56vU%2BF%2BcMi7iXrutxLQPZ4Vo7zNdRiN%2BzlJZF4KoOIyXlFiqhpmLclj%2BhPOouNcuPUZahg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PleskLin
main.css
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/css/
50 KB
6 KB
Stylesheet
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/css/main.css
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
98f8b4b01ebae4460dd4c9b90a9c3a623f5263bfc51bcc3c8926ca3d4b8e9bdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"643e8633-c6cd"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eQhTkDKTslzUFMjj1BnrTSojtUN48unt3OtcLEuG7AIODBnDYDDhAQ%2FhhlvmrDZA4Ret%2FW6t%2Fq%2BMjepIEgbeBptKGupIkPHkP7mwgjBZQhKVPGyzqqqtnWsdnWw%2F6yaUdTgTvADHT5t9pQG9Hn5hPHbCSWMAvvo1XeZga6QGBceC1DQYTg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b9cbe6489042bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bootstrap.min.css
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/css/
201 KB
27 KB
Stylesheet
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/css/bootstrap.min.css
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
ed32594ab88d0b8594b1978ff2cb2489ae234186e9e3d6c404731aa04fe20abd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"643e8633-32532"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lGr4CGg0%2BWwRqQzNJ4juU0yJj%2B%2FRsmadHht1IW%2BblAnqN9VX9qWo%2FMGUq8AFglNCp%2Fic83Jk%2Bn%2FeCxUNSVUvV3d3kOMy8XD052pochCVjoFPeBrqsP9zb%2FD%2FInJco2wYvPevaQbx4sJFg%2BEB8q%2FzP15%2B16YrosDnnbZoCKRQfnmLjEbuiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b9cbe6489052bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
background.svg
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/images/
3 KB
2 KB
Image
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/images/background.svg
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"643e8633-a05"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I7PS1E%2Fd2cupsdCon31sD47MMk80UmCOj7jULjPpL6aoDIOixycLsLuYLbiae04LdyzbU2r5RhfSkRPHxGQRAXbnkbApcqmT0K97Dqp%2FjCtGxW4jnqa%2BnGSDuPHMlXA2NrChHFDumCOImunE3fpocTo1cryG%2Bq8naTuDtaeN75mZnBsZag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
7b9cbe64b9352bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.min.js
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/js/
91 KB
33 KB
Script
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/js/jquery.min.js
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"643e8633-16bac"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m6ZOrlKoHhGrbNWmobG%2Bxnbf1VxhTmrHke6TIIEHH1InE4dP0GYzrFKyxAPnYyFR2lIqp7HEyhOHhbqK3oI8n6EvvyqtKuGAjrhyt5eW49JFvNmTpcalGaxrDsRqCQE3XadK3VsBDhwoiR5qD2Aw%2B1MBgTOw6AHcblk5khvt%2FBJbqNQDUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b9cbe64b92c2bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.min.js
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/js/
86 KB
31 KB
Script
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/js/jquery.min.js
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"643e8633-15850"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FpDilRlUVvuU4NiytdVCs9ZtBaox2seWQE3Jkp%2FoKeCxBIwPLJOFTX5eex%2FoNiKycGf4LezUsUqbcrzNkI87N6n2Pb49diC2SpziPh5O2ZE5TtzQHV4TTvudIhsRLVQhfOSquJs2MJ%2Bnw8wSBtULfVuntsnBgMoWrb3FiFxzstPV9f41rg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b9cbe64b92f2bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
index.php
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/
Redirect Chain
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/js/popper.min.js
  • https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/index.php?redirection=
0
0
Script
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/index.php?redirection=
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.0.28
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.0.28
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1hSNLBi6ccRQsd5zadi0vRFof8eVtrK0jPkX0fuBd%2BpxvNXl7yzG4wXWw9KwIn9IJd1dE1C8S11e%2FpGmeDnjjZls1nO1ZeFDpzBdIUO6s8nFHsOtscF2L7ksi6z3wf945K7d6LWdk02Yy%2B1zMCb2ihNpArFISNXWq%2FzkiEGnjLDmDXHQNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
7b9cbe696efb2bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

pragma
no-cache
date
Tue, 18 Apr 2023 11:59:48 GMT
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.0.28, PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fXFAoAS0hGNoDF11F9mJetY%2B8XjBacdHjMOOH5RC%2F4h0svrWNxrVTudapCBe6IgpjIqo3G4BYb1yxzzIr1PKcRkGrO%2Bse2Lle80V8AClz1P4ohkA3mttiSfJrYUfH5gnx%2FTrfy4uJ57ELpeTVHfRroWXDXHeDAunX3g8Oj3ve%2FUnj7RCHA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
location
../index.php?redirection=
cache-control
no-store, no-cache, must-revalidate
cf-ray
7b9cbe64b9302bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT
main.js
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
7 KB
2 KB
Script
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/main.js
Requested by
Host: ab005363c00878976e4id6.logo-in-garn.de
URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
cb1b7d8d4cb4f503be126aaab18302b91acebb80d5f49b476c834c10fb9d76d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"643e8633-1b78"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U7RM06IXIXt%2FEyzh07WoND5S1Kdb5LcKvpAWmxNB9AAjlQ0YvAGTB3i0Hk700kNPJPYJzN7AF7MehZNw1nGma%2FOIduM0ElimZHCx%2B%2BK37GA7AffI6Oznlcr0MwVT3qZvjkCmaFU8Ckz3kXdsWcihNNrVlQ%2BcOFuLcNfsPRfWXUOd1HTB1g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b9cbe64b9322bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
img1.jpg
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/img/
1 MB
1 MB
Image
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/img/img1.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
08e44df79f033daeb0375efd0c62ec5e3b13467388ed36815062f89ab2662940

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"643e8633-1206e7"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UhfCC4DdirZY1LrAEldPzI53K9h6S%2Bs6Mqx5Mf%2BEd5Z0Lczj4CpONulbe00Mg79RCo1Tn0AselEUSB3yVut4LQqX5xhruI9EeFKkR%2BrXmzI6F62mvMhgTKBZh6StMyXbPxJoeholTLi8tJ5gz9O0cefoXVpyPk%2Fnx6WIsSKtoE%2Fn9JeY%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9cbe6a48262bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1181415
img2.jpg
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/img/
15 KB
16 KB
Image
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/img/img2.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
550778f7050b2f39fc38c8e326c78e0a53921774f9f39dd3685f1c73efee2613

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"643e8633-3dc0"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FLI8ieMytvO%2BqoOiuwv1vhXqyeCjq0Gq92JRanw%2FapwfF%2FHu8rEeSl6B1%2FxozdCI6Tzeeagi1r09mH0P2ksAJVShqOTq%2BZ57bO1hAQThJXX0FAtcrH3vcLcDa9%2BQw6evkeSGpZ9QmkXSFNIB9X2nA4E8vtTLFNX6akoan3%2B3dz41fDmm7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9cbe6a48282bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
15808
img3.jpg
ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/img/
274 KB
275 KB
Image
General
Full URL
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/img/img3.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
0caf058c53fc03f37915f7f4738582b863b20f34bf1bc53c890436bdf465dae0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 11:59:48 GMT
cf-cache-status
MISS
last-modified
Tue, 18 Apr 2023 11:59:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"643e8633-447d5"
x-powered-by
PleskLin
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lKS3sxpCDukO%2F4e2I6swj3D7LwUwmtyMRhESBcvuDyV54gPN9%2FQZCbYmVa3uV1KjsX06MFGY7oBTMTWgiesXJceB%2BXZ69IEUilzfw2LkQ30QqrAw5voxk1piEuXY5PY0oL5qlvQYjglXVU48Kno3SPlrg9fujAwlz1c9xIKdG1j4JENSOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b9cbe6a48292bea-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
280533

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
ab005363c00878976e4id6.logo-in-garn.de/ Name: PHPSESSID
Value: 5qfpvgiok00ttahq4ag6s8t7f3

1 Console Messages

Source Level URL
Text
network error URL: https://ab005363c00878976e4id6.logo-in-garn.de/pst/6b4aa1715ac423b4122f/templates/index.php?redirection=
Message:
Failed to load resource: the server responded with a status of 500 ()