serveice-de-center.xyz
Open in
urlscan Pro
2606:4700:3030::681b:9bd8
Malicious Activity!
Public Scan
Effective URL: https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/rai_login?17577109=17577109&idloginform=92881997039453442...
Submission: On April 23 via manual
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 17th 2020. Valid for: 6 months.
This is the only time serveice-de-center.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Volksbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 192.129.175.98 192.129.175.98 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
2 2 | 2606:4700:303... 2606:4700:3037::6812:382d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 16 | 2606:4700:303... 2606:4700:3030::681b:9bd8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 2 |
ASN54290 (HOSTWINDS, US)
PTR: hwsrv-717733.hostwindsdns.com
service-pruef-service-de.email |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
serveice-de-center.xyz
2 redirects
serveice-de-center.xyz |
182 KB |
2 |
shrt-cut.xyz
2 redirects
shrt-cut.xyz |
831 B |
2 |
service-pruef-service-de.email
2 redirects
service-pruef-service-de.email |
812 B |
1 |
bit.ly
1 redirects
bit.ly |
268 B |
14 | 4 |
Domain | Requested by | |
---|---|---|
16 | serveice-de-center.xyz |
2 redirects
serveice-de-center.xyz
|
2 | shrt-cut.xyz | 2 redirects |
2 | service-pruef-service-de.email | 2 redirects |
1 | bit.ly | 1 redirects |
14 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-04-17 - 2020-10-09 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/rai_login?17577109=17577109&idloginform=92881997039453442005805517069951393688633763873323329537132886193107975359620628255727920255359755888018315803504413003904147823408927283634663784175374982147079720159726086231011708539266145871456577349023497369207014661613385906645670198627930859797861286368950656289962380509037062585841618956377875438467493593012113511534275188137987983773205173171230450996386196882514904069165788266872647794241401017963207673093121865802032433100302628205102482538194587502647592688987984743604964705132903622
Frame ID: 713D10A1651407B5E3B85CFF855F4DA5
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e3...
HTTP 301
https://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e3... HTTP 301
https://bit.ly/2VHXOQx HTTP 301
http://shrt-cut.xyz/?u=Wq0E HTTP 301
https://shrt-cut.xyz/?u=Wq0E HTTP 302
https://serveice-de-center.xyz/ Page URL
-
https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd
HTTP 301
http://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ HTTP 301
https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ Page URL
- https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/rai_login?17577109=17577109&idloginfo... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce
HTTP 301
https://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce HTTP 301
https://bit.ly/2VHXOQx HTTP 301
http://shrt-cut.xyz/?u=Wq0E HTTP 301
https://shrt-cut.xyz/?u=Wq0E HTTP 302
https://serveice-de-center.xyz/ Page URL
-
https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd
HTTP 301
http://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ HTTP 301
https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ Page URL
- https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/rai_login?17577109=17577109&idloginform=92881997039453442005805517069951393688633763873323329537132886193107975359620628255727920255359755888018315803504413003904147823408927283634663784175374982147079720159726086231011708539266145871456577349023497369207014661613385906645670198627930859797861286368950656289962380509037062585841618956377875438467493593012113511534275188137987983773205173171230450996386196882514904069165788266872647794241401017963207673093121865802032433100302628205102482538194587502647592688987984743604964705132903622 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce HTTP 301
- https://service-pruef-service-de.email/mw/index.php/campaigns/xj788tyv1r26b/track-url/sj798xocmaea6/79d073427cc75e32015320c1ae9367c5a06a34ce HTTP 301
- https://bit.ly/2VHXOQx HTTP 301
- http://shrt-cut.xyz/?u=Wq0E HTTP 301
- https://shrt-cut.xyz/?u=Wq0E HTTP 302
- https://serveice-de-center.xyz/
- https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd HTTP 301
- http://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ HTTP 301
- https://serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
serveice-de-center.xyz/ Redirect Chain
|
5 B 553 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ Redirect Chain
|
2 B 507 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
rai_login
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ |
11 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
functions.js
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/assets/js/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/assets/js/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
volksbank.css
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/ |
225 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
responsive.css
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/ |
67 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
design.css
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/ |
80 B 209 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hilfe.jpg
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/img/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
array.jpg
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/img/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
up.jpg
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/cssvolks/img/ |
22 KB 22 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
329 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timezone.php
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ |
0 175 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timezone.php
serveice-de-center.xyz/banking/8hg3ur7lfkzb942jysv05opmniqatd/ |
0 110 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Volksbank (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Aes object| Base64 object| Utf8 string| he12p string| gea string| output string| ctrTxt function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
serveice-de-center.xyz/ | Name: PHPSESSID Value: ssvs8hvjs0rq4ais3l3euqbpig |
|
.serveice-de-center.xyz/ | Name: __cfduid Value: d962150f3d8590fe6c3093b9a8483b7961587640356 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
serveice-de-center.xyz
service-pruef-service-de.email
shrt-cut.xyz
192.129.175.98
2606:4700:3030::681b:9bd8
2606:4700:3037::6812:382d
67.199.248.10
222d770aeffae244101da1ae3c157ccf7135a71923703173c35751c3bd18868f
3e1584f5d1eef2d0d815ae6b3c2f6be610c6947d312b6573c02d96dfcdda5c4e
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
861eba7e283d6f7f342fb806e81882126efbc0f0f9da931653bb84f3a770f8ed
867b8aef6ed637992e814f0c2a2631575d461b362e309f21862796216b38219c
8889290353b976b6daa1b18d84d35e3660c3c8382012de18bb127fcee492f44c
a07e35a0a48199eb5cde940517b95ba921bb4a58e173dfea2468c5e4b5578897
c3f57a62d865ac54a3c8e41657b057220e3dea2a94b1662f40e3a470c42919e9
c5e82c983e0c377abdb421f93fe1591c356320b5ffad0a85c562186d29f508ff
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9bcf04a450538a155a0e7dcdcd1c0a3c8ee1d005a930f00a1ef8576afb3560c
fba03cce80d8546b358bc244d15aac835d63d2b1cb83ae9ee04d13bd63850ef9