False Positive | targobank-kontowechselservice.de

[hanno-kortekamp]

What are the subjects of the false-positive (domains, URLs, or IPs)?

• targobank-kontowechselservice.de
• www.targobank-kontowechselservice.de

Why do you believe this is a false-positive?

We are operating this site (a service for switching bank accounts) on behalf of Targobank. We assume someone mistakenly thought it was phishing and reported it.

The bank links to our service from their site: https://www.targobank.de/de/service/kontowechselservice/index.html

Could you please whitelist / remove the domains from your blacklists?

How did you discover this false-positive(s)?

VirusTotal

Where did you find this false-positive if not listed above?

VirusTotal

Have you requested a review from other sources?

No response

Do you have a screenshot?

No response

Additional Information or Context

No response

[phishing-database-bot]

Verification Required

@hanno-kortekamp, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

   • Record Name: _phishingdb
   • Record Value: antiphish-6145ac0e011e2868e46b7c3fe1a49940b6305830

   Your Verification ID: antiphish-6145ac0e011e2868e46b7c3fe1a49940b6305830

2. Wait for DNS propagation (this may take a few minutes to a few hours).

3. Reply to this issue once the TXT record has been set.

Important Notes

• Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
• If the record cannot be set or you need alternative methods of verification, please contact us at contact@phish.co.za - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

• Online tools like Google's Dig Tool or MXToolBox TXT Lookup.
• The command line:

  dig TXT _phishingdb.example.com
  

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.

[hanno-kortekamp]

The DNS entry has been set. Please proceed..

Best regards
Hanno

[spirillen]

DNS Check

ptcheck targobank-kontowechselservice.de antiphish-6145ac0e011e2868e46b7c3fe1a49940b6305830
The test value matches the DNS TXT record.

Thanks for using my tools.
Please consider a sponsor ship at https://www.mypdns.org/donate

Know records

Please tell me what you know about these active records

Subject                                                                                              Status      Source     Expiration Date   HTTP Code  Checker       Tested At          
---------------------------------------------------------------------------------------------------- ----------- ---------- ----------------- ---------- ------------- -------------------
https://targobank-kontowechselservice.de/Login.aspx?ReturnUrl=                                       ACTIVE      HTTP CODE  Unknown           200        AVAILABILITY  19. Feb 2025 15:32:16
https://www.targobank-kontowechselservice.de/Login.aspx?ReturnUrl=/Default.aspx                      ACTIVE      HTTP CODE  Unknown           200        AVAILABILITY  19. Feb 2025 15:32:16
http://targobank-kontowechselservice.de                                                              ACTIVE      HTTP CODE  Unknown           200        AVAILABILITY  19. Feb 2025 15:32:16
https://www.targobank-kontowechselservice.de/Login.aspx?ReturnUrl=                                   ACTIVE      HTTP CODE  Unknown           200        AVAILABILITY  19. Feb 2025 15:32:16
https://www.targobank-kontowechselservice.de                                                         ACTIVE      HTTP CODE  Unknown           200        AVAILABILITY  19. Feb 2025 15:32:17

Execution Time: 00:00:00:1.913875



Status      Percentage   Amount      
----------- ------------ ------------
ACTIVE      100%         5           
INACTIVE    0%           0           
INVALID     0%           0 

---

Thank you for reaching out. I want to clarify that I am not the owner of this project. I assist with the whitelisting of domains to the best of my ability, but I do this as an unpaid volunteer in my free time. Your understanding and patience are greatly appreciated.

If you feel inclined to buy me a cup of coffee, it would certainly help speed up the process, but please know that it will not influence my decisions or verdicts in any way.

Additionally, I want to be very clear: I do not access any Cloudflare, Cloudfront, or Google networks. This is a matter of principle for me, as I believe in upholding human rights, the right to online privacy, and network security. These services often intercept traffic to collect personally identifiable information (PII), which I believe compromises our autonomy and makes us all puppets to the big tech puppeteers.

Thank you for your understanding!

Best regards, @spirillen

[hanno-kortekamp]

Hi @spirillen,

regarding "Please tell me what you know about these active records":

All of the listed entries point to the same site. It is a site where customers can switch their bank account from another bank to Targobank (a German bank).

We operate this site for Targobank who link to our application from their main site (see https://www.targobank.de/de/service/kontowechselservice/index.html).

It is a legit site that has nothing to do with phishing. Please whitelist it.

Best regards, @hanno-kortekamp

[spirillen]

Evening @hanno-kortekamp

Fielen Danke fur ihren reply... (probably with some errors, not speaking German that often any more)

Thanks for letting me know you are aware of the records and everything seems fine from your end, as reviewing as a outside, it looks rather suspicious.

Would it be at your likening if we whitelist as regex?

^(www|\.)targobank-kontowechselservice\.de

Or would you prefer a two liner like

www.targobank-kontowechselservice.de
targobank-kontowechselservice.de

Or the worst

www.targobank-kontowechselservice.de
.targobank-kontowechselservice.de # this is a wildcard of all subdomains

Personally I would go for option 1 or 2 as these limits the number of whitelisted domain, minimizing the risk for your domain to be targeted in the future a bit

[hanno-kortekamp]

Option 1 (regex) is completely good for us. Thanks you very much for your quick help, @spirillen

[spirillen]

Your welcome :)

Re: Whitelist Request Update

Added with: Phishing-Database/phishing@62f0f56

I want to start by saying that I currently do not have any further options to assist you regarding the whitelisting process, as it all hinges on the issue outlined in this issue.

Thank you for your patience as we navigate the whimsical world of whitelisting! Unfortunately, we can’t wrap up your request just yet, as we’re currently waiting on a little help from our friend @funilrys over at that issue. It seems the handling of whitelists in the Phishing-Database project has hit a bit of a snag, and @funilrys is the only one with the keys to the server that processes this data.

If you could kindly pop over to that issue and request that other trusted System Administrators gain access to the server for restarting the failed jobs, it would be immensely helpful. The more voices we have, the better!

Additionally, I must inform you that I do not have any power regarding the whitelisting processes on VirusTotal. For further requests about being whitelisted on VirusTotal, I recommend reaching out to their support platform and directing their attention towards this issue and the one at this issue to see if that can assist in getting you removed from VT.

In the meantime, here’s our usual standard answer regarding the visibility of changes:

• The change should be visible to Phishing-Database within a few hours.
• It can take a few days before you see any changes on VirusTotal, Contact VT.

Thanks for your understanding, and let’s get this sorted out together!

Cheers!