![](/screenshots/3eef49a2-a0cc-45d3-8f35-292bf4482744.png)
home-login-postfinance.on.drv.tw
Open in
urlscan Pro
47.88.48.79
Malicious Activity!
Public Scan
Submission: On December 17 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on November 2nd 2023. Valid for: 3 months.
This is the only time home-login-postfinance.on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostFinance (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 7 | 47.88.48.79 47.88.48.79 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 147.50.231.65 147.50.231.65 | 9891 (CSLOX-IDC...) (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.) | |
1 | 20.50.153.39 20.50.153.39 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2600:9000:205... 2600:9000:2057:c200:5:6c74:c540:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2a00:1450:400... 2a00:1450:4001:802::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:803::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4860:480... 2001:4860:4802:32::36 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:400c:c0b::9c | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::2003 | 15169 (GOOGLE) (GOOGLE) | |
22 | 12 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
home-login-postfinance.on.drv.tw |
ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: killadds.co.uk
farmchokchai.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
drv.tw
2 redirects
home-login-postfinance.on.drv.tw www.drv.tw — Cisco Umbrella Rank: 951051 cdn-of.drv.tw |
447 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2189 |
21 KB |
3 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 36 |
224 KB |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 75 |
405 B |
2 |
google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2693 |
320 B |
1 |
google.de
www.google.de — Cisco Umbrella Rank: 6765 |
408 B |
1 |
farmchokchai.com
farmchokchai.com |
3 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 735 |
30 KB |
0 |
jkdluxlimo.com
Failed
jkdluxlimo.com Failed |
|
22 | 9 |
Domain | Requested by | |
---|---|---|
7 | home-login-postfinance.on.drv.tw |
2 redirects
home-login-postfinance.on.drv.tw
|
3 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | region1.analytics.google.com |
www.googletagmanager.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | cdn-of.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | www.google.de |
home-login-postfinance.on.drv.tw
|
1 | region1.google-analytics.com |
www.googletagmanager.com
|
1 | www.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | farmchokchai.com |
home-login-postfinance.on.drv.tw
|
1 | code.jquery.com |
home-login-postfinance.on.drv.tw
|
0 | jkdluxlimo.com Failed |
code.jquery.com
|
22 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2023-11-02 - 2024-01-31 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
farmchokchai.com R3 |
2023-11-23 - 2024-02-21 |
3 months | crt.sh |
www.drv.tw GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2023-07-31 - 2024-01-31 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
www.google.de GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://home-login-postfinance.on.drv.tw/mein/home.html
Frame ID: B63DE83A20A2696E40AF02AF1AE9A891
Requests: 22 HTTP requests in this frame
Screenshot
![](/screenshots/3eef49a2-a0cc-45d3-8f35-292bf4482744.png)
Page Title
PostFinance - E-FinanceDetected technologies
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW06-Light.23770ae90a0ac3d5.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b?ra=4710wvNOubV8Up98zIkr2x2LwtiM2XGHQFSARASkWAKYgCaYOxl6xTFlXADBgoiidMj81USTLAgMwgOa7KVlrOEV-a2b52Hkd6cnBuLETwQvSjf_JYU97NUtGT0OK7iynwzbkR3hssuJ6ZY8yL2P0c5Hh3oJhtKJMm8ql_6hDh9XIEW46WaDhF4T8fI0K3B4nmsGhPlLfKa39lAByb_BfA0a.92ay
- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW05-Medium.58a0ff866e7c76b1.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH?ra=4710wvNOubV8Up98zIkr2x2LwtiM2XGHQFSARASkWAKYgCaYOxl6xTFlXADBgoiidMj81USTLAgMwgOa7KVlrOEV-a2b52Hkd6cnBuLETwQvSjf_JYU97NUtGT0OK7iynwzbkR3hssuJ6ZY8yL2P0c5Hh3oJhtKJMm8ql_6hDh9XIEW46WaDhF4T8fI0K3B4nmsGhPlLfKa39lAByb_BfA0a.92ay
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.html
home-login-postfinance.on.drv.tw/mein/ |
143 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.f88b886e8d70eb8b.css
home-login-postfinance.on.drv.tw/mein/log_files/ |
202 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.ccs.js
farmchokchai.com/home/mein/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 841 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.9e673858d384d2a88ba2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
61 KB 14 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other.baa9f8e29ae4e29778d2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
13 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
42 KB 43 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.ce995d22237219656e3a.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
1 MB 281 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
132 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
41 KB 42 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
file.php
jkdluxlimo.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
218 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
285 KB 93 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 266 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 266 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 47 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 219 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 358 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jkdluxlimo.com
- URL
- https://jkdluxlimo.com/file.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostFinance (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery string| base_url string| chat_id function| checkStatus function| cleanUp function| validate function| formatString function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
home-login-postfinance.on.drv.tw/ | Name: uid Value: rBSZwGV+WFZm3mCKS62QAg== |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1702778969.1.0.1702778969.0.0.0 |
|
.drv.tw/ | Name: _ga Value: GA1.2.364430183.1702778970 |
|
.drv.tw/ | Name: _gid Value: GA1.2.850116701.1702778970 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga_LHL0SH0Z7S Value: GS1.1.1702778970.1.0.1702778970.60.0.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-of.drv.tw
code.jquery.com
farmchokchai.com
home-login-postfinance.on.drv.tw
jkdluxlimo.com
region1.analytics.google.com
region1.google-analytics.com
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.google.de
www.googletagmanager.com
jkdluxlimo.com
147.50.231.65
20.50.153.39
2001:4860:4802:32::36
2001:4860:4802:34::36
2600:9000:2057:c200:5:6c74:c540:93a1
2a00:1450:4001:802::2008
2a00:1450:4001:803::200e
2a00:1450:4001:813::2003
2a00:1450:400c:c0b::9c
2a04:4e42:400::649
47.88.48.79
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1f36ed77df4925dfdd69129329b51cb52991fb97d9203faa34b60e76d76b8ab2
36468d7978ef11b2f74e03b789af70980e839aff47b9336f867aedeca554688c
3e8e3d05b2aa56e2a6bbee7f067e9e47d23349847c88f53bec7d2f2d7400f501
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cd0831888af056208066accccd9de5470925b62abd26b87dd672eeb72975f26
9e3c106724b88a584f5510a4ec193bfc8930a976236617f50c023e6a5ca7eb38
b3a4c6d80924b21816ac4ad6ebcbe55a56a17259c250be7fb31b31f16faeedf7
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079
d57f0454f106eff11c18b45792a1be05ca0cd79ea653a201a37939e8235eff73
ddcf221f9ba32ec5d0bd05ad2207e370e7d399e7dd348ea1fee2c0e7c1135c0d
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea973ba7beb8f95ee114ab45a171b0e0ddc50ba57932183de17c4449809cb818
eefdd7c444466c4be5cb7bcbecf734105f956618aa3dce6bc4794c6b19cde608
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629