home-login-postfinance.on.drv.tw
Open in
urlscan Pro
47.251.10.111
Malicious Activity!
Public Scan
Effective URL: https://home-login-postfinance.on.drv.tw/mein/home.html
Submission: On April 11 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 27th 2024. Valid for: 3 months.
This is the only time home-login-postfinance.on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostFinance (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 8 | 47.251.10.111 47.251.10.111 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
1 | 147.50.231.65 147.50.231.65 | 9891 (CSLOX-IDC...) (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.) | |
1 | 20.50.153.39 20.50.153.39 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2600:9000:205... 2600:9000:2057:200:5:6c74:c540:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2a00:1450:400... 2a00:1450:4001:806::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:80b::200e | 15169 (GOOGLE) (GOOGLE) | |
3 | 2001:4860:480... 2001:4860:4802:32::36 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:400c:c00::9b | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.217.16.195 172.217.16.195 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.217.16.200 172.217.16.200 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:828::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2001 | 15169 (GOOGLE) (GOOGLE) | |
24 | 13 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
home-login-postfinance.on.drv.tw |
ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: killadds.co.uk
farmchokchai.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
region1.google-analytics.com | |
region1.analytics.google.com |
ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
drv.tw
3 redirects
home-login-postfinance.on.drv.tw www.drv.tw cdn-of.drv.tw |
447 KB |
4 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 44 |
260 KB |
3 |
google.com
1 redirects
region1.analytics.google.com — Cisco Umbrella Rank: 3038 drive.google.com — Cisco Umbrella Rank: 314 |
2 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35 region1.google-analytics.com — Cisco Umbrella Rank: 2490 |
21 KB |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 94 |
405 B |
1 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 50 |
784 B |
1 |
google.de
www.google.de — Cisco Umbrella Rank: 7531 |
63 B |
1 |
farmchokchai.com
farmchokchai.com |
3 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 806 |
30 KB |
0 |
jkdluxlimo.com
Failed
jkdluxlimo.com Failed |
|
24 | 10 |
Domain | Requested by | |
---|---|---|
8 | home-login-postfinance.on.drv.tw |
3 redirects
home-login-postfinance.on.drv.tw
|
4 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | region1.analytics.google.com |
www.googletagmanager.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | cdn-of.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | lh3.googleusercontent.com | |
1 | drive.google.com | 1 redirects |
1 | www.google.de |
home-login-postfinance.on.drv.tw
|
1 | region1.google-analytics.com |
www.googletagmanager.com
|
1 | www.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | farmchokchai.com |
home-login-postfinance.on.drv.tw
|
1 | code.jquery.com |
home-login-postfinance.on.drv.tw
|
0 | jkdluxlimo.com Failed |
code.jquery.com
|
24 | 14 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2024-02-27 - 2024-05-27 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
farmchokchai.com R3 |
2024-03-22 - 2024-06-20 |
3 months | crt.sh |
www.drv.tw GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2023-12-18 - 2024-06-18 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://home-login-postfinance.on.drv.tw/mein/home.html
Frame ID: FC3AFF5BF331B1D7BDA58F97119C12F3
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
PostFinance - E-FinancePage URL History Show full URLs
-
http://home-login-postfinance.on.drv.tw/mein/home.html
HTTP 307
https://home-login-postfinance.on.drv.tw/mein/home.html Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://home-login-postfinance.on.drv.tw/mein/home.html
HTTP 307
https://home-login-postfinance.on.drv.tw/mein/home.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW06-Light.23770ae90a0ac3d5.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b?ra=4710AjLYD3_h5epoh2Je296XKWiM2XGHQFSARASgWAKYgCawDQYDoRNgSbxdleS42YE15zbyNr8NCjgaoSjv1NDxbK0xX_bE_5iRisHY3axHI_m726naXZtlcS9ptzL2M3lN-d-j3NEiCpVRSfNBif4NdSztRT4_aqXiDjc6GNAhNlYXzMIuRP0w8A3PPdWF6uREfq1H3I-ZqBR-3N25dA0a.92ay
- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW05-Medium.58a0ff866e7c76b1.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH?ra=4710AjLYD3_h5epoh2Je296XKWiM2XGHQFSARASgWAKYgCawDQYDoRNgSbxdleS42YE15zbyNr8NCjgaoSjv1NDxbK0xX_bE_5iRisHY3axHI_m726naXZtlcS9ptzL2M3lN-d-j3NEiCpVRSfNBif4NdSztRT4_aqXiDjc6GNAhNlYXzMIuRP0w8A3PPdWF6uREfq1H3I-ZqBR-3N25dA0a.92ay
- https://home-login-postfinance.on.drv.tw/mein/log_files/favicon.ico HTTP 302
- https://drive.google.com/thumbnail?sz=w1000&id=1sdymtCmcA_rfPMIrz_ipPMIEnrFDf6fK HTTP 302
- https://lh3.googleusercontent.com/d/1sdymtCmcA_rfPMIrz_ipPMIEnrFDf6fK=w1000
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.html
home-login-postfinance.on.drv.tw/mein/ Redirect Chain
|
143 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.f88b886e8d70eb8b.css
home-login-postfinance.on.drv.tw/mein/log_files/ |
202 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.ccs.js
farmchokchai.com/home/mein/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 841 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.9e673858d384d2a88ba2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
61 KB 14 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other.baa9f8e29ae4e29778d2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
13 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
42 KB 43 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.ce995d22237219656e3a.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
1 MB 281 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
195 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
41 KB 42 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
file.php
jkdluxlimo.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
239 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
309 KB 102 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 266 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 257 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 257 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ga-audiences
www.google.de/ads/ |
42 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 219 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 148 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
a
www.googletagmanager.com/ |
0 11 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1sdymtCmcA_rfPMIrz_ipPMIEnrFDf6fK=w1000
lh3.googleusercontent.com/d/ Redirect Chain
|
479 B 784 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jkdluxlimo.com
- URL
- https://jkdluxlimo.com/file.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostFinance (Banking)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| base_url string| chat_id function| checkStatus function| cleanUp function| validate function| formatString function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
home-login-postfinance.on.drv.tw/ | Name: uid Value: rBI/+mYYX6SNzitaOPU1Ag== |
|
.drv.tw/ | Name: _ga_LHL0SH0Z7S Value: GS1.1.1712873382.1.0.1712873382.60.0.0 |
|
.drv.tw/ | Name: _ga Value: GA1.2.956596774.1712873382 |
|
.drv.tw/ | Name: _gid Value: GA1.2.68609686.1712873382 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1712873382.1.0.1712873385.0.0.0 |
|
.google.com/ | Name: NID Value: 513=OhRm0U_v3iwS8J2L9Q8TsgvnS9Wb2p-KkTwvsd20jZT7ebdK2xIRfYqXEfsedMjzpvIm6tUR51oiOeKU2gbx5SLwSLAZbFKheRJ3a_5iQXT9OXfb-CaKTIDfkCjAgaiRyViuUO8w4A_Zhi7XIhvoBMXyAVELO72WIUmPYOA_X7g |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-of.drv.tw
code.jquery.com
drive.google.com
farmchokchai.com
home-login-postfinance.on.drv.tw
jkdluxlimo.com
lh3.googleusercontent.com
region1.analytics.google.com
region1.google-analytics.com
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.google.de
www.googletagmanager.com
jkdluxlimo.com
147.50.231.65
172.217.16.195
172.217.16.200
20.50.153.39
2001:4860:4802:32::36
2600:9000:2057:200:5:6c74:c540:93a1
2a00:1450:4001:806::2008
2a00:1450:4001:80b::200e
2a00:1450:4001:828::200e
2a00:1450:4001:82a::2001
2a00:1450:400c:c00::9b
2a04:4e42:600::649
47.251.10.111
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1f36ed77df4925dfdd69129329b51cb52991fb97d9203faa34b60e76d76b8ab2
356c480c5404e55142ac202d238947430921783d9a85b025f8fa891ed606e94f
36468d7978ef11b2f74e03b789af70980e839aff47b9336f867aedeca554688c
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cd0831888af056208066accccd9de5470925b62abd26b87dd672eeb72975f26
9e3c106724b88a584f5510a4ec193bfc8930a976236617f50c023e6a5ca7eb38
b2ee225bf23c3dac95f72d663c4047e77ec91e1fea4b9e6a3350d7118d531124
b5f1a139e80b358d136b5b4b1b3e4b8a73bafe2c0f3f675675e4346c269ccfad
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079
d4685b53de7476be13db9367b22e1a8302e644e1c3cb866a8e8a4faca1f9dd56
d57f0454f106eff11c18b45792a1be05ca0cd79ea653a201a37939e8235eff73
ddcf221f9ba32ec5d0bd05ad2207e370e7d399e7dd348ea1fee2c0e7c1135c0d
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea973ba7beb8f95ee114ab45a171b0e0ddc50ba57932183de17c4449809cb818
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629