erholung-postbank-6152-de.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://erholung-postbank-6152-de.web.app/
Submission Tags: tweet @atomspam #phishing #postbank #bank #infosec #cybersecurity #atomspam Search All
Submission: On February 01 via api (February 1st 2023, 8:51:28 am UTC) from FI — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is erholung-postbank-6152-de.web.app.
TLS certificate: Issued by GTS CA 1D4 on December 19th 2022. Valid for: 3 months.

This is the only time erholung-postbank-6152-de.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 15	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	52.21.160.1 52.21.160.1	14618 (AMAZON-AES) (AMAZON-AES)
15	3

15 2620:0:890::100 (United States) 1 redirects

ASN54113 (FASTLY, US)

erholung-postbank-6152-de.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.21.160.1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-160-1.compute-1.amazonaws.com

ipgeolocation.abstractapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	web.app 1 redirects erholung-postbank-6152-de.web.app	1 MB
1	abstractapi.com ipgeolocation.abstractapi.com — Cisco Umbrella Rank: 69275	1 KB
15	2

	Domain	Requested by
15	erholung-postbank-6152-de.web.app	1 redirects erholung-postbank-6152-de.web.app
1	ipgeolocation.abstractapi.com	erholung-postbank-6152-de.web.app
15	2

This site contains no links.

Subject Issuer	Validity	Valid
web.app GTS CA 1D4	`2022-12-19` - `2023-03-19`	3 months	crt.sh
ipgeolocation.abstractapi.com Amazon	`2022-05-23` - `2023-06-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://erholung-postbank-6152-de.web.app/
Frame ID: C32A2BEEA57976CB33E53EB11A798AB2
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

- Login - Postbank Banking & Brokerage

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1483 kB
Transfer

6811 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://erholung-postbank-6152-de.web.app/static/js//firebase-database.js HTTP 301
https://erholung-postbank-6152-de.web.app/static/js/firebase-database.js

15 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
erholung-postbank-6152-de.web.app/ 2 MB
308 KB 164ms
42ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0780ae2e01f467a4b2fd47ee2229d595747957297dd5f48bcae134b0bef02b43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 315114
content-type: text/html; charset=utf-8
date: Wed, 01 Feb 2023 08:51:22 GMT
etag: "f151fbd7a39f1752b17ccc2ded122eac8341c453319943ceb6a241070e2adae5-br"
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-hhn-etou8220025-HHN
x-timer: S1675241483.518508,VS0,VE1

GET
H2 200 bootstrap.min.css
erholung-postbank-6152-de.web.app/static/css/ 152 KB
17 KB 42ms
41ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/css/bootstrap.min.css

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220025-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.763597,VS0,VE0
etag: "ffbe5d2fc77cd73de3a35501dca574f3fac11a92797d5f6dff867eef995f70ac-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 17149
x-cache-hits: 15

GET
H2 200 jquery-1.11.3.min.js Show response
erholung-postbank-6152-de.web.app/static/js/ 94 KB
29 KB 43ms
43ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220025-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.763758,VS0,VE1
etag: "b6b08d428122637779e159a9b697cb9acaf823e2b24090a09efb6541697a2845-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 29961
x-cache-hits: 1

GET
H2 200 firebase-app.js Show response
erholung-postbank-6152-de.web.app/static/js/ 20 KB
6 KB 43ms
42ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/js/firebase-app.js

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6704c8c217305558f1238332118ecb9184dfc060541bf9bf09b8b35bed5d7789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220025-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.785952,VS0,VE1
etag: "2428682042c4bdef4c14c62d6b0290eccae86213431583b4c7f600f912d9d88c-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5832
x-cache-hits: 1

GET
H3

200

firebase-database.js Show response
erholung-postbank-6152-de.web.app/static/js/
Redirect Chain

https://erholung-postbank-6152-de.web.app/static/js//firebase-database.js
https://erholung-postbank-6152-de.web.app/static/js/firebase-database.js

188 KB
43 KB

42ms
42ms

Script
text/javascript

2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/js/firebase-database.js

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d7d2640fe6a4d1fffff63feaedc932df97522a06845016952e173b753fd47640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.839312,VS0,VE1
etag: "23253b0d2d5688db7ffbc571a7c0cffd79ac81c8ed663f7f1abe0ebb929b8209-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 44023
x-cache-hits: 1

Redirect headers

x-served-by: cache-hhn-etou8220025-HHN
date: Wed, 01 Feb 2023 08:51:22 GMT
x-content-type-options: nosniff
x-timer: S1675241483.786049,VS0,VE12
x-frame-options: SAMEORIGIN
x-cache: MISS
content-type: text/html; charset=utf-8
location: /static/js/firebase-database.js
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 66
x-xss-protection: 0
x-cache-hits: 0

GET
H2 200 jquery.mask.min.js Show response
erholung-postbank-6152-de.web.app/static/js/ 7 KB
3 KB 44ms
43ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/js/jquery.mask.min.js

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5f8e21f061de1874e4af063f095a389187c40583c9033946e406a8bb825ca358

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220025-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.786380,VS0,VE1
etag: "411ec26e684e3f32282c5a00109a30e6ab5c87e6811121c24e7404ff2ad06426-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2804
x-cache-hits: 1

GET
H2 200 jquery.payment.min.js Show response
erholung-postbank-6152-de.web.app/static/js/ 8 KB
2 KB 43ms
42ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/js/jquery.payment.min.js

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220025-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.786362,VS0,VE1
etag: "6e8cc12c583296e1e70e1d759db68b3aea66338edc38a90e225aa9b1234b889a-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2423
x-cache-hits: 1

GET
H2 200 script.js Show response
erholung-postbank-6152-de.web.app/static/js/ 12 KB
3 KB 44ms
44ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/js/script.js

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b60bd4309bc32f3b4ec1d05945a4a734ff1a8f245437bf334bb673c216422acb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220025-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.786381,VS0,VE1
etag: "ab0af68a20d5386b88a5a4671812225f37a4291005093554472ddd3a5cf6b71c-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3428
x-cache-hits: 1

GET
H3 200 /
erholung-postbank-6152-de.web.app/ 2 MB
308 KB 42ms
42ms Stylesheet
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0780ae2e01f467a4b2fd47ee2229d595747957297dd5f48bcae134b0bef02b43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.920075,VS0,VE1
etag: "f151fbd7a39f1752b17ccc2ded122eac8341c453319943ceb6a241070e2adae5-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 315114
x-cache-hits: 1

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1016 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 48 KB
48 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c

Request headers

Referer
Origin: https://erholung-postbank-6152-de.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 41 KB
41 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d

Request headers

Referer
Origin: https://erholung-postbank-6152-de.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H3 200 wait Show response
erholung-postbank-6152-de.web.app/static/model/ 2 KB
954 B 106ms
105ms XHR
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/model/wait

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a71de533cc68299854f3d6a1c5f566ae59ecdef770a2310ddc974bc1decdbb0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: text/html, */*; q=0.01
Referer: https://erholung-postbank-6152-de.web.app/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:22 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.938320,VS0,VE1
etag: "a12aaa80b86bb5a14c4decfebf5d46230e6a2ec821da7e69a891373f5dda9e58-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 608
x-cache-hits: 1

GET
H2 200 / Show response
ipgeolocation.abstractapi.com/v1/ 931 B
1 KB 397ms
130ms XHR
application/json 52.21.160.1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ipgeolocation.abstractapi.com/v1/?api_key=e8ed642bc1cc48f1a9cd4bd3ee35bbf2

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.21.160.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-21-160-1.compute-1.amazonaws.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d9550aa9d045a010cab59eb0ea9669588ccf60c9b6d0caa21da7893f81e75275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://erholung-postbank-6152-de.web.app/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Wed, 01 Feb 2023 08:51:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: same-origin
server: nginx/1.14.0 (Ubuntu)
vary: Cookie, Origin
allow: GET, HEAD, OPTIONS
content-type: application/json
x-frame-options: DENY
access-control-allow-origin: *
content-length: 931

GET
H3 200 jswait Show response
erholung-postbank-6152-de.web.app/static/model/ 0
335 B 41ms
41ms XHR
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/model/jswait

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://erholung-postbank-6152-de.web.app/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Wed, 01 Feb 2023 08:51:23 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241483.046493,VS0,VE1
etag: "46b50c321b39e89a491b6727a01628c34245605a30beb3e7414c5e01cff90e6e"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 0
x-cache-hits: 1

GET
H3 200 log Show response
erholung-postbank-6152-de.web.app/static/model/ 912 KB
670 KB 43ms
43ms XHR
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/model/log

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3425be2e4d72a11ac22008800d8907fbcbd4a4062d89ebc6ccbdb8e8be685700

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: text/html, */*; q=0.01
Referer: https://erholung-postbank-6152-de.web.app/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:24 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241484.439577,VS0,VE2
etag: "bb970e1e672953dfb0066e31bdbd24394489ae67801b6099fabaea09b6bdb1df-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 685926
x-cache-hits: 1

GET
H3 404 svg-icon-sprite.svg
erholung-postbank-6152-de.web.app/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/ 0
0 43ms
43ms Other
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://erholung-postbank-6152-de.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
date: Wed, 01 Feb 2023 08:51:24 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241485.533841,VS0,VE3
etag: "daa499dd96d8229e73235345702ba32f0793f0c8e5c0d30e40e37a5872be57aa"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 853
x-cache-hits: 1

GET
H3 200 jslog Show response
erholung-postbank-6152-de.web.app/static/model/ 179 B
446 B 42ms
41ms XHR
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://erholung-postbank-6152-de.web.app/static/model/jslog

Requested by

Host: erholung-postbank-6152-de.web.app
URL: https://erholung-postbank-6152-de.web.app/static/js/jquery-1.11.3.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3594914b7297144d63c386fd42cdbba6959955fcfbca5c04d4cd4cc85fe995de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://erholung-postbank-6152-de.web.app/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-served-by: cache-hhn-etou8220051-HHN
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 01 Feb 2023 08:51:24 GMT
last-modified: Tue, 31 Jan 2023 15:11:26 GMT
x-timer: S1675241485.548818,VS0,VE1
etag: "2e527892028e66139c53d1758f03dee862469e00fcb07f018c4ac5d74b6b7967-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 101
x-cache-hits: 1

GET
DATA 200
OK truncated
/ 612 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 545d99b57daa48a5fd7781e1ace4be2422a069625a8c71924d2a245998755df7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 50 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1dba4aed649c01e3a9864ed3313c4b506525c74e107760f113b31dc044a0f452

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://erholung-postbank-6152-de.web.app/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg#icon-cross Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

erholung-postbank-6152-de.web.app
ipgeolocation.abstractapi.com
2620:0:890::100
52.21.160.1
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c
0780ae2e01f467a4b2fd47ee2229d595747957297dd5f48bcae134b0bef02b43
1dba4aed649c01e3a9864ed3313c4b506525c74e107760f113b31dc044a0f452
2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d
3425be2e4d72a11ac22008800d8907fbcbd4a4062d89ebc6ccbdb8e8be685700
3594914b7297144d63c386fd42cdbba6959955fcfbca5c04d4cd4cc85fe995de
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20
545d99b57daa48a5fd7781e1ace4be2422a069625a8c71924d2a245998755df7
5f8e21f061de1874e4af063f095a389187c40583c9033946e406a8bb825ca358
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6704c8c217305558f1238332118ecb9184dfc060541bf9bf09b8b35bed5d7789
6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37
a71de533cc68299854f3d6a1c5f566ae59ecdef770a2310ddc974bc1decdbb0a
b60bd4309bc32f3b4ec1d05945a4a734ff1a8f245437bf334bb673c216422acb
d7d2640fe6a4d1fffff63feaedc932df97522a06845016952e173b753fd47640
d9550aa9d045a010cab59eb0ea9669588ccf60c9b6d0caa21da7893f81e75275
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

erholung-postbank-6152-de.web.app Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

93 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

1483 kBTransfer

6811 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

erholung-postbank-6152-de.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1483 kB
Transfer

6811 kB
Size

0
Cookies

15 HTTP transactions
8 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!