lidl-aktualisierung.de Open in urlscan Pro
2606:4700:3037::6815:2bc3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://lidl-aktualisierung.de/
Submission: On September 27 via automatic, source phishtank (September 27th 2022, 6:30:40 pm UTC) — Scanned from DE

Summary HTTP 12 Redirects Links 41 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3037::6815:2bc3, located in United States and belongs to CLOUDFLARENET, US. The main domain is lidl-aktualisierung.de.

This is the only time lidl-aktualisierung.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address		AS Autonomous System
6	2606:4700:303... 2606:4700:3037::6815:2bc3		13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b		20446 (STACKPATH...) (STACKPATH-CDN)
2	2a04:4e42::485 2a04:4e42::485		54113 (FASTLY) (FASTLY)
1 2	185.85.0.144 185.85.0.144		20546 (SOPRADO-ANY) (SOPRADO-ANY)
12	4

6 2606:4700:3037::6815:2bc3 (United States)

ASN13335 (CLOUDFLARENET, US)

lidl-aktualisierung.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.85.0.144 (Germany) 1 redirects

ASN20546 (SOPRADO-ANY, DE)
PTR: ip-185-85-0-144.ax5z.com

sparkasse.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.sparkasse.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	lidl-aktualisierung.de lidl-aktualisierung.de	12 KB
3	jquery.com code.jquery.com — Cisco Umbrella Rank: 654	215 KB
2	sparkasse.de 1 redirects sparkasse.de — Cisco Umbrella Rank: 177119 www.sparkasse.de — Cisco Umbrella Rank: 229902	14 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 392	22 KB
12	4

	Domain	Requested by
6	lidl-aktualisierung.de	lidl-aktualisierung.de
3	code.jquery.com	lidl-aktualisierung.de
2	cdn.jsdelivr.net	lidl-aktualisierung.de
1	www.sparkasse.de	lidl-aktualisierung.de
1	sparkasse.de	1 redirects
12	5

This site contains links to these domains. Also see Links.

Domain
www.sparkasse.de

Subject Issuer	Validity	Valid
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-03-21` - `2023-04-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://lidl-aktualisierung.de/
Frame ID: E039D2BF652B5E0C239EC16A3A3DF8D6
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Internet-Filiale - Sparkasse

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*parbase

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

12
Requests

42 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

261 kB
Transfer

1004 kB
Size

0
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sparkasse.de/

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/sicherheit-im-internet.html
Title: Sicherheitshinweise

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/iban-rechner.html
Title: IBAN und BIC berechnen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/karte-sperren.html
Title: Kartenverlust melden

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/online-banking.html
Title: Online-Kunde werden

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto.html
Title: Online-Banking-Hilfe

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/adressaenderung.html
Title: Adresse ändern

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/dispokredit.html
Title: Dispositionskredit einrichten oder ändern

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/aktuelles/gutscheine-als-geschenk.html
Title: Gutscheine kaufen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/girokonto.html
Title: Girokonto

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/tagesgeldkonto.html
Title: Tagesgeldkonto

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/sparen-anlegen/festgeldkonto.html
Title: Festgeldkonto

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/sparen-anlegen/sparbuch.html
Title: Sparbuch

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/karten/aufladbare-kreditkarte.html
Title: Aufladbare Kreditkarte

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/karten/kreditkarte.html
Title: Kreditkarte

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/altersvorsorge/riester-rente.html
Title: Riester-Rente

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen.html
Title: Kredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/privatkredit.html
Title: Privatkredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/autokredit.html
Title: Autokredit

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/baufinanzierung.html
Title: Baufinanzierung

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/bausparen-bausparvertrag.html
Title: Bausparen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/bauspardarlehen.html
Title: Bauspardarlehen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/kredite-finanzierungen/hypothekendarlehen.html
Title: Hypothekendarlehen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/themen.html
Title: Ihre Pläne

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/mehr-als-geld.html
Title: GemeinsamAllemGewachsen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/aktuelles.html
Title: Aktuelle Themen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/firmenkunden.html
Title: Firmenkunden

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/sparen-anlegen.html
Title: Sparen & Anlegen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/altersvorsorge.html
Title: Altersvorsorge

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/versicherungen.html
Title: Versicherungen

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/karriere.html
Title: Karriere

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/filialen.html
Title: Filialen A-Z

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/geldautomaten.html
Title: Geldautomaten A-Z

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/finanzlexikon.html
Title: Finanzlexikon

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/sepa.html
Title: SEPA

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/infocenter/sicherungssystem.html
Title: Sicherungssystem

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/unsere-loesungen/privatkunden/rund-ums-konto/sparkassen-apps.html
Title: Sparkassen Apps

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/service/wir-ueber-uns.html
Title: Wir über uns

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/datenschutz.html
Title: Datenschutz

Search URL Search Domain Scan URL

URL: https://www.sparkasse.de/nutzungshinweise.html
Title: Nutzungshinweise

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://sparkasse.de/content/dam/sparkasse/logo_ini.svg HTTP 301
https://www.sparkasse.de/content/dam/sparkasse/logo_ini.svg

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
lidl-aktualisierung.de/ 61 KB
12 KB 464ms
428ms Document
text/html 2606:4700:3037::6815:2bc3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://lidl-aktualisierung.de/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:2bc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0accf4b895b8494fff44a924fec3380a55c6b49671db4a0b5ce6f9c8052c65d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 75164fb4d95c91ea-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 27 Sep 2022 18:30:35 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qf%2FZrP1HLqxwwRL6fJRDz06rxx1tsIWOn2MOqX9Jjr011u3tMYI5pEfRMRlqgerJyIpC8zAeJf5lSXOV%2BVso%2FHTF8L73Pz9eRWjpSJUE2ajIoVbweOvwu9tLJ12eE6ElSsmOfSRk0Y9oCsy0Dun18dcggE8U"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 404
Not Found app.css
lidl-aktualisierung.de/oauth2/css/ 0
0 415ms
414ms Stylesheet
text/html 2606:4700:3037::6815:2bc3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://lidl-aktualisierung.de/oauth2/css/app.css
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:2bc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 18:30:35 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3%2FmVFaKyA07vo4JqSAdMnPwG2vRIxciS1ANgxTdUpSxMcau4xuAabjY2Dw5O44VBdlZzlMMGnAG3%2FZen0Tj9Y7CjU89mRofe0Qztj3SAKWa1BZZirUPdUKQShPM5opIWwnNyx2G8hksdPmwaq4xgfPFUhKUz"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 75164fb78f3d91ea-FRA

GET
H/1.1 404
Not Found opsm.css
lidl-aktualisierung.de/oauth2/css/ 0
0 445ms
424ms Stylesheet
text/html 2606:4700:3037::6815:2bc3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://lidl-aktualisierung.de/oauth2/css/opsm.css
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:2bc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 18:30:35 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HR42EZiLR2HcbVqW6YtOzRoeJJnLlNypopa3VYNizHuZqhFqH3TxRsTGz2Sut1hwq0EfufBqNtha8Sds9ptmK0QqktPIqReKN9dVKXT%2BqoRPm21tFKpHTe5ijsqYpGKRQmYu2eA3IFWJfUNS5x7miZwyc6vQ"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 75164fb7aa3d9bb2-FRA

GET
H/1.1 404
Not Found opttan.css
lidl-aktualisierung.de/oauth2/css/ 0
0 424ms
403ms Stylesheet
text/html 2606:4700:3037::6815:2bc3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://lidl-aktualisierung.de/oauth2/css/opttan.css
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:2bc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 18:30:35 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z1pSJYuu9ef98pU8QqWW8a8PHlb8A3En08yPmuReOHP86AAZbL0pvMC12yoqfKjttNRItGv2GBq%2F%2FaZaP7D%2FKXH9h0sRxqGEzfcAh7JfEp%2FAwHDgUq%2BHV7ttWCbYONC%2BYkOiPdSGbaw3JRVkUaifzIylIqTz"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 75164fb7ac4f917c-FRA

GET
H/1.1 404
Not Found perf-meter.css
lidl-aktualisierung.de/oauth2/css/ 0
0 447ms
425ms Stylesheet
text/html 2606:4700:3037::6815:2bc3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://lidl-aktualisierung.de/oauth2/css/perf-meter.css
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:2bc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 18:30:35 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eXGnpctWfTkiEGdO2n9UPtnpjvmKUWJAkh893ujixEFJ6RGMZgOPV1f0Wt551OPnT0PwPC9bsOFmAgxV0XKOCeGL64Vw31l0UKv81a8IYuGfp%2FK63pTCpl%2BIJlAJUtb%2BYO5h7GhlWvczgC%2F%2FC01UwkCwm87u"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 75164fb7ac98906c-FRA

GET
H/1.1 404
Not Found ospm_custom.css
lidl-aktualisierung.de/oauth2/css/ 0
0 433ms
411ms Stylesheet
text/html 2606:4700:3037::6815:2bc3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://lidl-aktualisierung.de/oauth2/css/ospm_custom.css
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:2bc3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 18:30:35 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9bTJKBePLAnJI8iEJNAb2pLmPz19ugrKK6y33BSd9FKnyHM92hLGzVe1lARY1Xg0DkEcvBr%2FS5sKN31mOkRDbKj0YKHODlkOQgYTEaeGpcgiIBg7FW9fnNi9eiNff7KdFUX5qXgXYidkajNESVBuXT7f0%2BV"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html; charset=iso-8859-1
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 75164fb7ade392b4-FRA

GET
H2 200 jquery-ui.css
code.jquery.com/ui/1.13.1/themes/base/ 35 KB
8 KB 332ms
265ms Stylesheet
text/css 2001:4de0:ac18::1:a:3b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.13.1/themes/base/jquery-ui.css
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 58a6f49e92f7d2fd1246d98c568c2ac7d6be832ddfece67ec9f7ef3332766adf

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 18:30:35 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:40 GMT
server: nginx
etag: W/"620cd700-8d03"
vary: Accept-Encoding
x-hw: 1664303435.dop129.fr8.t,1664303435.cds011.fr8.hn,1664303435.cds141.fr8.c
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 8356

GET
H2 200 jquery-3.6.0.js Show response
code.jquery.com/ 282 KB
83 KB 386ms
319ms Script
application/javascript 2001:4de0:ac18::1:a:3b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.js
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 18:30:35 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-46744"
vary: Accept-Encoding
x-hw: 1664303435.dop129.fr8.t,1664303435.cds011.fr8.hn,1664303435.cds148.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 84714

GET
H2 200 jquery-ui.js Show response
code.jquery.com/ui/1.13.1/ 517 KB
123 KB 479ms
412ms Script
application/javascript 2001:4de0:ac18::1:a:3b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.13.1/jquery-ui.js
Requested by: Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 18:30:35 GMT
content-encoding: gzip
last-modified: Thu, 20 Jan 2022 14:12:59 GMT
server: nginx
etag: W/"61e96deb-812a6"
vary: Accept-Encoding
x-hw: 1664303435.dop129.fr8.t,1664303435.cds011.fr8.hn,1664303435.cds242.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 126241

GET
H2 200 select2.min.css
cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/ 16 KB
3 KB 68ms
19ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/select2.min.css

Requested by

Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 16449790
x-jsd-version: 4.1.0-rc.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2162
etag: W/"3f88-kT+fe5U1rseQyjzp1uNaz682mZM"
x-served-by: cache-fra19137-FRA, cache-hhn4041-HHN
x-jsd-version-type: version
date: Tue, 27 Sep 2022 18:30:35 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 select2.min.js Show response
cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/js/ 71 KB
20 KB 68ms
20ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/js/select2.min.js

Requested by

Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

f7244fff610595b944f76bf3080d74e3af42b5dd234f8f079e698cc39ac966b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 9156772
x-jsd-version: 4.1.0-rc.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 20012
etag: W/"11dcb-beEOdKmS/KFegD2RDRMPgmYxy4Y"
x-served-by: cache-fra19177-FRA, cache-hhn4041-HHN
x-jsd-version-type: version
date: Tue, 27 Sep 2022 18:30:35 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2

200

logo_ini.svg
www.sparkasse.de/content/dam/sparkasse/
Redirect Chain

https://sparkasse.de/content/dam/sparkasse/logo_ini.svg
https://www.sparkasse.de/content/dam/sparkasse/logo_ini.svg

22 KB
11 KB

60ms
44ms

Image
image/svg+xml

185.85.0.144
SOPRADO-ANY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sparkasse.de/content/dam/sparkasse/logo_ini.svg

Requested by

Host: lidl-aktualisierung.de
URL: http://lidl-aktualisierung.de/

Protocol

H2

Server

185.85.0.144 , Germany, ASN20546 (SOPRADO-ANY, DE),

Reverse DNS

ip-185-85-0-144.ax5z.com

Software

myracloud /

Resource Hash

2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' 'self' platform.twitter.com cdn.syndication.twimg.com cdn.tagcommander.com cdn.trustcommander.net connect.facebook.net t23.intelliad.de www.youtube.com player.vimeo.com s.ytimg.com .adform.net analytics-udg.netdna-ssl.com www.google-analytics.com www.google.com www.googleadservices.com www.googletagmanager.com www.gstatic.com maps.googleapis.com optimize.google.com api.instagram.com .kameleoon.com .kameleoon.eu www.yellowmap.de cdn.yellowmap.de prod.pszahlen.de plugins.flockler.com cdn.trkkn.com; style-src 'self' 'unsafe-inline' platform.twitter.com ton.twimg.com fonts.googleapis.com static.kameleoon.com cdn.yellowmap.de; img-src data: 'self' 'unsafe-inline' platform.twitter.com syndication.twitter.com .twimg.com .yellowmaps.eu www.yellowmap.de map.iib-institut.de sparkassenfinanzportalgmbh.d3.sc.omtrdc.net www.facebook.com .xx.fbcdn.net .cdninstagram.com www.google-analytics.com www.google.com www.google.de storage.googleapis.com .doubleclick.net maps.gstatic.com maps.googleapis.com img.youtube.com .tagcommander.com .commander1.com .trustcommander.net .kameleoon.com .kameleoon.eu images.sparkasse.de static-immobilien.sparkasse.de t23.intelliad.de feeds.sparkassen-finanzportal.de media-api.flockler.com; media-src api.sparkassen-mediacenter.de youtu.be sparkasse-a.akamaihd.net contentangebote.sparkassen-finanzportal.de cdn.plyr.io detektor.fm www.youtube.com; frame-src data: 'self' platform.twitter.com syndication.twitter.com cdn.tagcommander.com cdn.trustcommander.net track.adform.net server.adform.net compass.pressekompass.net .kameleoon.com .kameleoon.eu www.google.com sparkasse.linda-chatbot.de dsv.pi-asp.de if.sparkassen-finanzportal.de widget.civey.com www.youtube.com player.vimeo.com systems.sparkassen-finanzportal.de; font-src webfonts.sparkasse.de cdn.yellowmap.de fonts.gstatic.com; connect-src 'self' www.google-analytics.com .doubleclick.net cdn.plyr.io vimeo.com .commander1.com .trustcommander.net proxy-immobilien.sparkasse.de .kameleoon.com .kameleoon.eu autocomplete.smartmaps.cloud *.yellowmap.de feeds.sparkassen-finanzportal.de contentangebote.sparkasse.de; prefetch-src 'self' sparkasse.mein-check-in.de www.f-i.de; object-src 'self'; manifest-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://lidl-aktualisierung.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' 'self' platform.twitter.com cdn.syndication.twimg.com cdn.tagcommander.com cdn.trustcommander.net connect.facebook.net t23.intelliad.de www.youtube.com player.vimeo.com s.ytimg.com *.adform.net analytics-udg.netdna-ssl.com www.google-analytics.com www.google.com www.googleadservices.com www.googletagmanager.com www.gstatic.com maps.googleapis.com optimize.google.com api.instagram.com *.kameleoon.com *.kameleoon.eu www.yellowmap.de cdn.yellowmap.de prod.pszahlen.de plugins.flockler.com cdn.trkkn.com; style-src 'self' 'unsafe-inline' platform.twitter.com ton.twimg.com fonts.googleapis.com static.kameleoon.com cdn.yellowmap.de; img-src data: 'self' 'unsafe-inline' platform.twitter.com syndication.twitter.com *.twimg.com *.yellowmaps.eu www.yellowmap.de map.iib-institut.de sparkassenfinanzportalgmbh.d3.sc.omtrdc.net www.facebook.com *.xx.fbcdn.net *.cdninstagram.com www.google-analytics.com www.google.com www.google.de storage.googleapis.com *.doubleclick.net maps.gstatic.com maps.googleapis.com img.youtube.com *.tagcommander.com *.commander1.com *.trustcommander.net *.kameleoon.com *.kameleoon.eu images.sparkasse.de static-immobilien.sparkasse.de t23.intelliad.de feeds.sparkassen-finanzportal.de media-api.flockler.com; media-src api.sparkassen-mediacenter.de youtu.be sparkasse-a.akamaihd.net contentangebote.sparkassen-finanzportal.de cdn.plyr.io detektor.fm www.youtube.com; frame-src data: 'self' platform.twitter.com syndication.twitter.com cdn.tagcommander.com cdn.trustcommander.net track.adform.net server.adform.net compass.pressekompass.net *.kameleoon.com *.kameleoon.eu www.google.com sparkasse.linda-chatbot.de dsv.pi-asp.de if.sparkassen-finanzportal.de widget.civey.com www.youtube.com player.vimeo.com systems.sparkassen-finanzportal.de; font-src webfonts.sparkasse.de cdn.yellowmap.de fonts.gstatic.com; connect-src 'self' www.google-analytics.com *.doubleclick.net cdn.plyr.io vimeo.com *.commander1.com *.trustcommander.net proxy-immobilien.sparkasse.de *.kameleoon.com *.kameleoon.eu autocomplete.smartmaps.cloud *.yellowmap.de feeds.sparkassen-finanzportal.de contentangebote.sparkasse.de; prefetch-src 'self' sparkasse.mein-check-in.de www.f-i.de; object-src 'self'; manifest-src 'self';
content-encoding: gzip
x-content-type-options: nosniff
content-disposition: attachment; filename="logo_ini.svg"
vary: accept-encoding
content-length: 8985
x-xss-protection: 1; mode=block
last-modified: Sun, 17 Mar 2019 15:37:12 GMT
server: myracloud
x-frame-options: SAMEORIGIN
date: Tue, 27 Sep 2022 18:30:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
cache-control: max-age=86400
accept-ranges: bytes
expires: Wed, 28 Sep 2022 18:30:36 GMT

Redirect headers

content-security-policy: default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' 'self' platform.twitter.com cdn.syndication.twimg.com cdn.tagcommander.com cdn.trustcommander.net connect.facebook.net t23.intelliad.de www.youtube.com player.vimeo.com s.ytimg.com *.adform.net analytics-udg.netdna-ssl.com www.google-analytics.com www.google.com www.googleadservices.com www.googletagmanager.com www.gstatic.com maps.googleapis.com optimize.google.com api.instagram.com *.kameleoon.com *.kameleoon.eu www.yellowmap.de cdn.yellowmap.de prod.pszahlen.de plugins.flockler.com cdn.trkkn.com; style-src 'self' 'unsafe-inline' platform.twitter.com ton.twimg.com fonts.googleapis.com static.kameleoon.com cdn.yellowmap.de; img-src data: 'self' 'unsafe-inline' platform.twitter.com syndication.twitter.com *.twimg.com *.yellowmaps.eu www.yellowmap.de map.iib-institut.de sparkassenfinanzportalgmbh.d3.sc.omtrdc.net www.facebook.com *.xx.fbcdn.net *.cdninstagram.com www.google-analytics.com www.google.com www.google.de storage.googleapis.com *.doubleclick.net maps.gstatic.com maps.googleapis.com img.youtube.com *.tagcommander.com *.commander1.com *.trustcommander.net *.kameleoon.com *.kameleoon.eu images.sparkasse.de static-immobilien.sparkasse.de t23.intelliad.de feeds.sparkassen-finanzportal.de media-api.flockler.com; media-src api.sparkassen-mediacenter.de youtu.be sparkasse-a.akamaihd.net contentangebote.sparkassen-finanzportal.de cdn.plyr.io detektor.fm www.youtube.com; frame-src data: 'self' platform.twitter.com syndication.twitter.com cdn.tagcommander.com cdn.trustcommander.net track.adform.net server.adform.net compass.pressekompass.net *.kameleoon.com *.kameleoon.eu www.google.com sparkasse.linda-chatbot.de dsv.pi-asp.de if.sparkassen-finanzportal.de widget.civey.com www.youtube.com player.vimeo.com systems.sparkassen-finanzportal.de; font-src webfonts.sparkasse.de cdn.yellowmap.de fonts.gstatic.com; connect-src 'self' www.google-analytics.com *.doubleclick.net cdn.plyr.io vimeo.com *.commander1.com *.trustcommander.net proxy-immobilien.sparkasse.de *.kameleoon.com *.kameleoon.eu autocomplete.smartmaps.cloud *.yellowmap.de feeds.sparkassen-finanzportal.de contentangebote.sparkasse.de; prefetch-src 'self' sparkasse.mein-check-in.de www.f-i.de; object-src 'self'; manifest-src 'self';
x-content-type-options: nosniff
server: myracloud
date: Tue, 27 Sep 2022 18:30:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/html; charset=iso-8859-1
location: https://www.sparkasse.de/content/dam/sparkasse/logo_ini.svg
x-xss-protection: 1; mode=block
cache-control: max-age=0
content-length: 267
etag: "myra-b4e226ac"
expires: Tue, 27 Sep 2022 18:30:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://lidl-aktualisierung.de/oauth2/css/app.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://lidl-aktualisierung.de/oauth2/css/opttan.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://lidl-aktualisierung.de/oauth2/css/ospm_custom.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://lidl-aktualisierung.de/oauth2/css/opsm.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://lidl-aktualisierung.de/oauth2/css/perf-meter.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
lidl-aktualisierung.de
sparkasse.de
www.sparkasse.de
185.85.0.144
2001:4de0:ac18::1:a:3b
2606:4700:3037::6815:2bc3
2a04:4e42::485
1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239
2ee73fd1898343f28de6ed91576db74c150e7f91fd9f6767ae1c52a503a4728a
58a6f49e92f7d2fd1246d98c568c2ac7d6be832ddfece67ec9f7ef3332766adf
cda4a81c187015d95ed2c71f1841540b08203cdec5fa2a7d5d1825a3c2166f8c
d0accf4b895b8494fff44a924fec3380a55c6b49671db4a0b5ce6f9c8052c65d
e97315234cc1f1c4737d98ea29c0f4d4f06c032dc5943012ae50bc4b10a92276
f7244fff610595b944f76bf3080d74e3af42b5dd234f8f079e698cc39ac966b0