www.google.ca
Open in
urlscan Pro
2a00:1450:4001:82f::2003
Malicious Activity!
Public Scan
Effective URL: https://www.google.ca/
Submission: On July 06 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1C3 on June 19th 2023. Valid for: 3 months.
This is the only time www.google.ca was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 11 | 45.88.108.231 45.88.108.231 | 44486 (SYNLINQ s...) (SYNLINQ synlinq.de) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 192.0.78.27 192.0.78.27 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 7 | 2a00:1450:400... 2a00:1450:4001:82f::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::200e | 15169 (GOOGLE) (GOOGLE) | |
20 | 8 |
ASN44486 (SYNLINQ synlinq.de, DE)
PTR: plesk1.living-bots.net
postbank.id.s-sterr.de |
ASN15169 (GOOGLE, US)
google.ca | |
www.google.ca |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
s-sterr.de
3 redirects
postbank.id.s-sterr.de |
543 KB |
7 |
google.ca
1 redirects
google.ca — Cisco Umbrella Rank: 5858 www.google.ca — Cisco Umbrella Rank: 8361 |
75 KB |
3 |
gstatic.com
fonts.gstatic.com www.gstatic.com |
73 KB |
1 |
google.com
apis.google.com — Cisco Umbrella Rank: 195 |
40 KB |
1 |
href.li
href.li — Cisco Umbrella Rank: 95176 |
312 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 749 |
30 KB |
20 | 6 |
Domain | Requested by | |
---|---|---|
11 | postbank.id.s-sterr.de |
3 redirects
postbank.id.s-sterr.de
|
6 | www.google.ca |
href.li
www.google.ca |
2 | www.gstatic.com |
www.google.ca
|
1 | apis.google.com |
www.gstatic.com
|
1 | fonts.gstatic.com |
www.google.ca
|
1 | google.ca | 1 redirects |
1 | href.li | |
1 | code.jquery.com |
postbank.id.s-sterr.de
|
20 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
about.google |
store.google.com |
mail.google.com |
www.google.de |
accounts.google.com |
support.google.com |
google.com |
sustainability.google |
policies.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
postbank.id.s-sterr.de R3 |
2023-07-05 - 2023-10-03 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
tls.automattic.com R3 |
2023-07-01 - 2023-09-29 |
3 months | crt.sh |
*.google.ca GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
*.apis.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.google.ca/
Frame ID: B5D91A6E9815D98FCFFB4DA2937F1F7C
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
GooglePage URL History Show full URLs
-
https://postbank.id.s-sterr.de/privatkunden/
HTTP 302
https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9 HTTP 301
https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/ HTTP 302
https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/index.php?login=TggiuG... Page URL
- https://href.li/https://google.ca Page URL
-
https://google.ca/
HTTP 301
https://www.google.ca/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
14 Outgoing links
These are links going to different origins than the main page.
Title: Ãœber Google
Search URL Search Domain Scan URL
Title: Store
Search URL Search Domain Scan URL
Title: Gmail
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Anmelden
Search URL Search Domain Scan URL
Title: Weitere Informationen
Search URL Search Domain Scan URL
Title: Wie funktioniert die Google Suche?
Search URL Search Domain Scan URL
Title: COâ‚‚-neutral seit 2007
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Title: Hilfe zur Suche
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://postbank.id.s-sterr.de/privatkunden/
HTTP 302
https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9 HTTP 301
https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/ HTTP 302
https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/index.php?login=TggiuGYIj3OglbeeoapOJPrXDafLsh Page URL
- https://href.li/https://google.ca Page URL
-
https://google.ca/
HTTP 301
https://www.google.ca/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://postbank.id.s-sterr.de/privatkunden/ HTTP 302
- https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9 HTTP 301
- https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/ HTTP 302
- https://postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/index.php?login=TggiuGYIj3OglbeeoapOJPrXDafLsh
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
index.php
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/ Redirect Chain
|
688 KB 161 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.ba1d58f32575e9f5.css
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/ |
272 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
212.png
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/img/ |
42 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pbbg.94a99b13acbdc92b.jpg
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/img/ |
243 KB 243 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/img/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icl1.svg
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerLTW05-65Bold.a18adccbfba3032a.woff2
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/fonts/ |
25 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerLTW05-55Roman.cc9768c5af9adc84.woff2
postbank.id.s-sterr.de/privatkunden/sfa1i9o1wrfzro8hi2x5k2ckwssax3o22wn9ack9/files/fonts/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google.ca
href.li/https:// |
408 B 312 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.google.ca/ Redirect Chain
|
223 KB 67 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
googlelogo_color_272x92dp.png
www.google.ca/images/branding/googlelogo/1x/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24px.svg
fonts.gstatic.com/s/i/productlogos/googleg/v6/ |
742 B 973 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
315 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
gen_204
www.google.ca/ |
0 19 B |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
desktop_searchbox_sprites318_hr.webp
www.google.ca/images/searchbox/ |
660 B 682 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
775 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
236 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
197 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
686 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
338 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gen_204
www.google.ca/ |
0 19 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=AA2YrTtIruYmuX8KutIB2oG3QaLQ5Y8PhQ
www.gstatic.com/og/_/js/k=og.qtm.en_US.4KEg_ddb4iw.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qald/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ |
198 KB 71 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=AA2YrTskQVuI_RegvjB3vE2uQHtwf-5cGg
www.gstatic.com/og/_/ss/k=og.qtm.gdDckMx1Njs.L.W.O/m=qcwid/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/ |
389 B 826 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
gen_204
www.google.ca/ |
0 19 B |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cb=gapi.loaded_0
apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uwHuQY_gg44.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_V1jKXTs4TkQZGty4n4aTwpK1Z_Q/ |
118 KB 40 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| google object| gws_wizbind object| _skwEvts object| gbar_ object| gbar string| __PVT object| gapi object| ___jsl object| __jsaction object| W_jd object| WIZ_global_data object| IJ_values function| _F_installCss string| _F_jsUrl object| _ function| _DumpException object| _s object| _qs object| jsl number| closure_uid_646160684 object| closure_lm_690864 object| osapi object| gadgets object| shindig object| googleapis4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
postbank.id.s-sterr.de/ | Name: PHPSESSID Value: kabn2efqpsk21guldokvo7vpav |
|
.google.ca/ | Name: CONSENT Value: PENDING+566 |
|
.google.ca/ | Name: AEC Value: Ad49MVHRtiodPZ6LjtxPhHkbbCLe0UE_sZgg6RxLa87MYV_dmGQI8N2tOg |
|
.google.ca/ | Name: __Secure-ENID Value: 13.SE=nHBiRjo4UTb1lcB-Th8X4r2U2iW9R19adD-9quUrWt-NzE1Ljw69MBOxjmlK1F186e7eLyeHtZ-3nhkfCluGH9dZgzvazCbRPyvuT_UIFWTvFwwIkZ8gjwpUK2Y99BZ1HaXAyOZzbv17vjeJ_z3rpvdr-70r37sZ6KLLd6Wv4s0 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apis.google.com
code.jquery.com
fonts.gstatic.com
google.ca
href.li
postbank.id.s-sterr.de
www.google.ca
www.gstatic.com
192.0.78.27
2001:4de0:ac18::1:a:3b
2a00:1450:4001:80b::200e
2a00:1450:4001:812::2003
2a00:1450:4001:827::2003
2a00:1450:4001:82f::2003
45.88.108.231
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1ba175c14a1b3e95fdac52043fdb52c13d7c709f25d3e2d176e21c9aef6d4a0f
1e641d94ac2d51089bf1282148963c8b2253dcfe089861537544b44b346672f0
228a729bd6316ceac03ebdf00ccfa5dab5429a38f0598ec0c9f228b16b26261f
32cd7f94eeaa01ac988f063230521b520f8a016478cfc1b642b6cf38e7faa63a
3541be1fcc06b7e84244cc310f2792469bf8ee453ecc5f30d1e6cba8b81df0e7
3a1b50a1f666f8b1066e77dcf76aa633d388452a4ca07482c9009dbe6b1ae31f
40988765b5729bf021191fda5e3243ceb16158a6a3f388e81a4904fe94f8257c
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
5776cd87617eacec3bc00ebcf530d1924026033eda852f706c1a675a98915826
592fa7f72e229674612ddb6f5578f05cdcd1e8aa470d3fa257415e2c7499e435
73d788f86be22112bb53762545989c0f1bbdb7343161130952c9ba3834ff81e3
8b01d1155941a02829ae5eaecfd86c83f7e7a5a6e34edd94a0b7780f4ae1ae78
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
948fe62ca3b291d8bccb2f4799f97bd46f1d670f85d8f275d0347f7398e50e99
b577857c178a06510ed5a51ef48205d61a43b7107be350535a41b08c8b870e3d
b5d67eaa85688500479563e35f5f52c860a32d66234bc5326b4acae00e20bf63
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
c0d951862e3083ea03599f7ce3f30d9ba224b3c8ef86b108c8f038f22d9bbc73
cc027a59513a3e1ce8cae404fcd958540b2b6b908e8a3f700ccb245d539703e2
dd87b792c00fd312a8975cc2181340ca6a2f1f7d96679bfe10978b7a7b5117e6
dfc968774223d526b5bd576d65d52926560be675eb4d289e4b50b6b2d1c4c34c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed9087d76cdc6d1c53698f6068f79872e77e87c8d012c0cfdad13b05b6ccb37c