![](/screenshots/4180bc25-6c5d-4c36-9b5f-ac31fc054ec9.png)
apppostbnk-de.com
Open in
urlscan Pro
2a02:4780:b:1110:0:10e0:3111:2
Malicious Activity!
Public Scan
Effective URL: https://apppostbnk-de.com/
Submission: On July 18 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on July 16th 2023. Valid for: 3 months.
This is the only time apppostbnk-de.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 2a02:4780:b:1... 2a02:4780:b:1110:0:10e0:3111:2 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 2 | 2606:4700:20:... 2606:4700:20::681a:85b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
12 | 4 |
ASN47583 (AS-HOSTINGER, CY)
apppostbnk-de.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
apppostbnk-de.com
1 redirects
apppostbnk-de.com |
308 KB |
2 |
tailwindcss.com
1 redirects
cdn.tailwindcss.com — Cisco Umbrella Rank: 72755 |
107 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 433 |
34 KB |
0 |
postbank.de
Failed
meine.postbank.de Failed |
|
12 | 4 |
Domain | Requested by | |
---|---|---|
7 | apppostbnk-de.com |
1 redirects
apppostbnk-de.com
|
2 | cdn.tailwindcss.com |
1 redirects
apppostbnk-de.com
|
1 | ajax.googleapis.com |
apppostbnk-de.com
|
0 | meine.postbank.de Failed |
apppostbnk-de.com
|
12 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
apppostbnk-de.com ZeroSSL RSA Domain Secure Site CA |
2023-07-16 - 2023-10-14 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://apppostbnk-de.com/
Frame ID: 36095BFA305991479264891E505EDE9C
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/4180bc25-6c5d-4c36-9b5f-ac31fc054ec9.png)
Page Title
PostbankPage URL History Show full URLs
-
http://apppostbnk-de.com/
HTTP 301
https://apppostbnk-de.com/ Page URL
Detected technologies
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://apppostbnk-de.com/
HTTP 301
https://apppostbnk-de.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://cdn.tailwindcss.com/ HTTP 302
- https://cdn.tailwindcss.com/3.3.2
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
apppostbnk-de.com/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.3.2
cdn.tailwindcss.com/ Redirect Chain
|
349 KB 107 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
apppostbnk-de.com/ |
2 KB 587 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
apppostbnk-de.com/assets/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a.jpeg
apppostbnk-de.com/assets/ |
174 KB 174 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b.jpeg
apppostbnk-de.com/assets/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c.jpeg
apppostbnk-de.com/assets/ |
113 KB 113 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
437 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
430 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
471 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
FrutigerLTW02-65Bold.woff2
meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
FrutigerLTW02-55Roman.woff2
meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
FrutigerLTW02-65Bold.woff
meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
FrutigerLTW02-55Roman.woff
meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- meine.postbank.de
- URL
- https://meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/FrutigerLTW02-65Bold.woff2
- Domain
- meine.postbank.de
- URL
- https://meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/FrutigerLTW02-55Roman.woff2
- Domain
- meine.postbank.de
- URL
- https://meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/FrutigerLTW02-65Bold.woff
- Domain
- meine.postbank.de
- URL
- https://meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/fonts/Frutiger/FrutigerLTW02-55Roman.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| tailwind string| /template.html function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
apppostbnk-de.com
cdn.tailwindcss.com
meine.postbank.de
meine.postbank.de
2606:4700:20::681a:85b
2a00:1450:4001:806::200a
2a02:4780:b:1110:0:10e0:3111:2
2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14
386e8f49fc617de15eb6907c324583d0f9c33dcf13f064acb72e4e76e67fd295
40b2904999a927d2b42a859697102f22c8ab2b6c19f7beac5648c53f89dced00
4a04c1723ed95cbc16c6c182a32af7a55b0e72a8935f3005e3d7c0f16b507f49
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
885e3c0d5e7f8cb0656dedeea902c91721f04b95f49d258f1a1009d6400536c3
8c46916ed891b104f6c77dfeb66228eb7e6f000555cefca420c056cfa4896387
a89301b42dd63117de4d783364bf8a00fca37983a3fbdb68e882e46be74cd289
b6fee381207d08fa8d029741f93662cf29622bb040a5d875bab0d68a1e93e6df
c95bd79683ca29f1edd1735e87a50a2180cc0e73509d4c81a8ec7744a3c04650
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b