www.sicherheitcenter-sp1.top
Open in
urlscan Pro
2400:cb00:2048:1::6818:7534
Malicious Activity!
Public Scan
Effective URL: https://www.sicherheitcenter-sp1.top/de/home/anmelden?ZLV8WBHveonR=78103617066358&mUCTyCFtKB4s6jRubA=ilCG0No4r1o0&979564139990
Submission: On September 05 via automatic, source phishtank
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on September 2nd 2018. Valid for: 6 months.
This is the only time www.sicherheitcenter-sp1.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sparkasse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
1 1 | 2400:cb00:204... 2400:cb00:2048:1::6818:75fd | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 16 | 2400:cb00:204... 2400:cb00:2048:1::6818:7534 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
15 | 1 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
shortxr5.co |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.sicherheitcenter-sp1.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
sicherheitcenter-sp1.top
1 redirects
www.sicherheitcenter-sp1.top |
142 KB |
1 |
shortxr5.co
1 redirects
shortxr5.co |
308 B |
1 |
bit.ly
1 redirects
bit.ly |
352 B |
15 | 3 |
Domain | Requested by | |
---|---|---|
16 | www.sicherheitcenter-sp1.top |
1 redirects
www.sicherheitcenter-sp1.top
|
1 | shortxr5.co | 1 redirects |
1 | bit.ly | 1 redirects |
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni225191.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-02 - 2019-03-11 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.sicherheitcenter-sp1.top/de/home/anmelden?ZLV8WBHveonR=78103617066358&mUCTyCFtKB4s6jRubA=ilCG0No4r1o0&979564139990
Frame ID: 017A332B87948ED513EBECE88F129CAC
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bit.ly/2C9CSeY
HTTP 301
https://shortxr5.co/?l=xdQ78nWJ HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden?ZLV8WBHveonR=78103617066358&mUCTyCFtKB4s6jRubA=ilCG0No4r1o0... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.ly/2C9CSeY
HTTP 301
https://shortxr5.co/?l=xdQ78nWJ HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden HTTP 302
https://www.sicherheitcenter-sp1.top/de/home/anmelden?ZLV8WBHveonR=78103617066358&mUCTyCFtKB4s6jRubA=ilCG0No4r1o0&979564139990 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
anmelden
www.sicherheitcenter-sp1.top/de/home/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Ke014037c23ce7cb75766e139184921585833a708
www.sicherheitcenter-sp1.top/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Kf113c65902b745110f1bf1dad75baf3f4b149407
www.sicherheitcenter-sp1.top/ |
16 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K24b3866668e612c307814a727867164a64a9e06b
www.sicherheitcenter-sp1.top/ |
84 KB 84 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K858980172267fc50b32e2d2d6df5d939778c964d
www.sicherheitcenter-sp1.top/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K64c5678cfb257af551850d413b9cfe807de66304
www.sicherheitcenter-sp1.top/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K4b54b5a691105998dcd245e3fa766420d86a2441
www.sicherheitcenter-sp1.top/ |
4 KB 1 KB |
Script
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Ka12465fa69c5f666a20ba98bab35cf721832006f
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K87d26f3a01af070d76bba9452abcab027b990611
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Kc359416d0ff2fb2b628f76026d2066fe66ad82df
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K753eeed753a32c6313ee4c217fe08d18d62f14e1
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K7814d013f9ee1f31d04dd6ccec535621b0371ac9
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Ke72b44dfae9ed472d73f422779c7c3a8e3098814
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K0aadaa6498ade1779904082971472b7f6b96af7c
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Kdf0fd58b9447cdea06d3813d3df9cb7cec7676d9
www.sicherheitcenter-sp1.top/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sparkasse (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| K66092da9121f4db4d3fa225d4c14d5b728e30e78 function| Kf48d8cc4477a56ef6f0951da22c7f8ddc344bb342 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.sicherheitcenter-sp1.top/ | Name: PHPSESSID Value: 02vk992n6bbiour7k0jbldith2 |
|
.sicherheitcenter-sp1.top/ | Name: __cfduid Value: de290f638b5390062a4daf13ace2d93151536190245 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
shortxr5.co
www.sicherheitcenter-sp1.top
2400:cb00:2048:1::6818:7534
2400:cb00:2048:1::6818:75fd
67.199.248.10
025e74a74fe143a118876d12b736f8fb0bcb43d96568221553bd83a7e7b1ac4f
1f2725cb5fbd2883fafabf2d39b563b555d5d38ed1a048b23f297866aa281903
3e5992af8ac7d2c4c356b6545ec6e5c128a014f9018f6b16616bdfe188862ff0
4aed1efbbe0bb753684998625ef250fb40086fa7806930d159d80499a5aaf753
74bcd86bc937c41e4045ef2a14f6619ffc828ceeca96e7c1946330c34abba648
b9797829fb133b5c591029045635cdb8166fbec2f2fd73d26b025d5287ea0209
d3d6aefec9d4c8294072e8a246a45716badf57373b71990f6254b4c480245288