sparka.info Open in urlscan Pro
2606:4700:3031::681f:45e7  Malicious Activity! Public Scan

URL: https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung...
Submission: On April 27 via automatic, source phishtank

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3031::681f:45e7, located in United States and belongs to CLOUDFLARENET, US. The main domain is sparka.info.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 25th 2020. Valid for: 6 months.
This is the only time sparka.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
8 2606:4700:303... 13335 (CLOUDFLAR...)
8 1
Apex Domain
Subdomains
Transfer
8 sparka.info
sparka.info
181 KB
8 1
Domain Requested by
8 sparka.info sparka.info
8 1

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2
2020-04-25 -
2020-10-09
6 months crt.sh

This page contains 1 frames:

Primary Page: https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
Frame ID: DF70E290CA727BEEAE3E5C122E7E44FC
Requests: 8 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<div class="[^"]*parbase/i

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • html /<div class="[^"]*parbase/i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

181 kB
Transfer

400 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request ob_anmeldung.php
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/
11 KB
3 KB
Document
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1db9b740c8a0936f424434ac6ed4ce4c945edb7d9d45caf282c69abbc96c2a1

Request headers

:method
GET
:authority
sparka.info
:scheme
https
:path
/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 27 Apr 2020 08:32:03 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=da5f097a88d18fb275fc1af959e1363161587976323; expires=Wed, 27-May-20 08:32:03 GMT; path=/; domain=.sparka.info; HttpOnly; SameSite=Lax PHPSESSID=tdb3jffi0ljavlgvab80mca9u4; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
58a730d49f910621-FRA
content-encoding
br
cf-request-id
025c5cd8e0000006212025c200000001
ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/css/
249 KB
38 KB
Stylesheet
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Requested by
Host: sparka.info
URL: https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8b51ca2d76d70709c6c9aa47b504dc4484cf89b508df064dc9c2b53d6ee75c4

Request headers

Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 08:32:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:00 GMT
server
cloudflare
age
1750
etag
W/"3e436-5a3fa667f3956;5a40ff0789cfc-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
58a730d8b8010621-FRA
cf-request-id
025c5cdb7700000621202b6200000001
ZR1pMwPB9Xsl53CW8qSL.png
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/img/
2 KB
2 KB
Image
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/img/ZR1pMwPB9Xsl53CW8qSL.png
Requested by
Host: sparka.info
URL: https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9e830e96a27b155e68fbf2bd76b10c2e9e054874c9c3c1e97bbaea573259894

Request headers

Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 08:32:03 GMT
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:04 GMT
server
cloudflare
age
1748
etag
"76e-5a3fa66c4070c;5a40ff0789cfc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
58a730d8c8040621-FRA
content-length
1902
cf-request-id
025c5cdb7800000621202b7200000001
WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/img/
3 KB
3 KB
Image
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/img/WwSGd09MRzJAkDH5sm3axX7OLpBbNV.png
Requested by
Host: sparka.info
URL: https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ef3568cb4cbc5b4a96dba63ccff15a441eac6d17c91fa963d2ac1b4534520d6

Request headers

Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 08:32:03 GMT
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:02 GMT
server
cloudflare
age
1749
etag
"aa9-5a3fa66a72456;5a40ff0789cfc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
58a730d8c80a0621-FRA
content-length
2729
cf-request-id
025c5cdb7800000621202b8200000001
spk-logo-druck.png
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/img/
10 KB
10 KB
Image
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/img/spk-logo-druck.png
Requested by
Host: sparka.info
URL: https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d16cd665d719c20820702b390ce43791ec4ae374d5233251b04d578264808684

Request headers

Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/ob_anmeldung.php?starten=jGeiP90YsS2AIKpMo6xO8TywB7RUFC&shufflUri?=FIsYm5DcRE2nrwJtMXC1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 08:32:03 GMT
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:05 GMT
server
cloudflare
age
1749
etag
"2740-5a3fa66ca8b0f;5a40ff0789cfc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
58a730d8c80c0621-FRA
content-length
10048
cf-request-id
025c5cdb7800000621202b9200000001
GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/fonts/
39 KB
39 KB
Font
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/fonts/GmtFBuKRSiNbVacYxEjhfTdWlAUkvrQDZqOpPsoeHCMIzyXJwgnL.woff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9ad5dac2a400c1fb324e09df57325568e98772618ff818ca5344b171c834aa2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Origin
https://sparka.info

Response headers

date
Mon, 27 Apr 2020 08:32:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:01 GMT
server
cloudflare
age
2737
etag
W/"9a44-5a3fa668c703c;5a40ff0789cfc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/font-woff
status
200
cache-control
max-age=14400
cf-ray
58a730d96abd0621-FRA
cf-request-id
025c5cdbe500000621202c6200000001
AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/fonts/
39 KB
38 KB
Font
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/fonts/AnMlPaDTHuRzxycBZkjWSbpGsLJghqIYXUFQrmvKNedifEtwCoVO.woff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3a096177fdb67dc609921050caec415a389d683674be529f2ba91f6e5514638

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Origin
https://sparka.info

Response headers

date
Mon, 27 Apr 2020 08:32:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:01 GMT
server
cloudflare
age
2738
etag
W/"9b38-5a3fa66933e76;5a40ff0789cfc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/font-woff
status
200
cache-control
max-age=14400
cf-ray
58a730d97ac40621-FRA
cf-request-id
025c5cdbe700000621202c7200000001
pictos-if.woff
sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/fonts/
48 KB
48 KB
Font
General
Full URL
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/fonts/pictos-if.woff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::681f:45e7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56666c32c5c048a791e99fafef70d3791d6d5c6d350771ffbb4e2119df335f03

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://sparka.info/943194/tMfsWFN3U0jRZem/o97knrx2VbqAdyU/648707755608/rt62SVplMx3bzcL/NXdaPI0mosh8buF/src/css/ngPAmjocXiwpUZyqlfQHsMNkDRhYtFVvIKCWrTOBaEGdxSLJzbue.css
Origin
https://sparka.info

Response headers

date
Mon, 27 Apr 2020 08:32:04 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2020 19:39:02 GMT
server
cloudflare
age
2737
etag
W/"be24-5a3fa669a2421;5a40ff0789cfc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/font-woff
status
200
cache-control
max-age=14400
cf-ray
58a730d97acb0621-FRA
cf-request-id
025c5cdbe900000621202c8200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

2 Cookies

Domain/Path Name / Value
sparka.info/ Name: PHPSESSID
Value: tdb3jffi0ljavlgvab80mca9u4
.sparka.info/ Name: __cfduid
Value: da5f097a88d18fb275fc1af959e1363161587976323