urlscan.io logo urlscan.io
SecurityTrails logo

0ed59bc.wcomhost.com Open in urlscan Pro
206.188.192.208  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxctTqnu0lVlcJIW-2FgiyV5hJl4hfIM5ynS5yvoOMphr0QNBv-2BB8-2F6v0-2...
Effective URL: https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
Submission: On April 13 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 206.188.192.208, located in Amarillo, United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is 0ed59bc.wcomhost.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 19th 2022. Valid for: a year.
This is the only time 0ed59bc.wcomhost.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
2 2 167.89.115.121 11377 (SENDGRID)
3 5 206.188.192.208 19871 (NETWORK-S...)
2 2
Apex Domain
Subdomains		 Transfer
5 wcomhost.com
0ed59bc.wcomhost.com
609 KB
2 sendgrid.net
u14178730.ct.sendgrid.net
956 B
2 2
Domain Requested by
5 0ed59bc.wcomhost.com 3 redirects 0ed59bc.wcomhost.com
2 u14178730.ct.sendgrid.net 2 redirects
2 2

This site contains links to these domains. Also see Links.

Domain
www.postbank.de
Subject Issuer Validity Valid
*.wcomhost.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-19 -
2023-09-19		 a year crt.sh

This page contains 1 frames:

Primary Page: https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
Frame ID: B03E0833A393577BB26AACD3FCD6E6EE
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Postbank Banking & Brokerage

Page URL History Show full URLs

  1. https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxctTqnu0lVlcJIW-2FgiyV5hJl4hfIM5ynS5yvoOMp... HTTP 302
    https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcheHyELy2cIe9ABAnNd7Mcq-2BgbgsD6qMaV-2Brq... HTTP 302
    https://0ed59bc.wcomhost.com/postede/pst/ HTTP 302
    https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99 HTTP 301
    http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/ HTTP 307
    https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/ Page URL
  2. https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients HTTP 301
    http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/ HTTP 307
    https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/ Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

659 kB
Transfer

1561 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxctTqnu0lVlcJIW-2FgiyV5hJl4hfIM5ynS5yvoOMphr0QNBv-2BB8-2F6v0-2BEJMSgsa2XkoSMd5s9g4SXb1X410fzb8qnShfLaSOicdXo-2Fw9qhxmrDkWdxd2yVP7rfRtkjbZFcytbbR3INIP0s1LNoK-2BGWfUcM-2BbUf0Fu9jhqae755IPhJ3QfKLlhWO0K8CddUj1-2BkKkpgbIjjSHLpRxaY-2BgZlm-2B006U4moCwn1S7wMxryDB1sU5cbut7TWM1Rwm5sxE2yKvYhfGujPzw0U3xh-2BDypEfmu1M2cK-2BRQa8oCB6PxL-2BEKRAs0iF9S9T7F62syGmDkGixp1mS0ReOSoAilq3W9tDHQiDVSYFqQr5JIxeqlMyRdm7mpoOYFmPv1V4SG0NGtZQBs4L7c1La5GcclOEahZskgb0EH2tBE66jcj6FTXeBhZwiIicdoa59-2BLK21e40GrDJ-2BuusErgX-2BVEHnrQVvwD95Ufwxk-2BYocOXQueuWmVHibQo3TWhJC2Dy6TQ8vmo8vEcIXJBxCWQHZq9FmaDnj-2Ful0OvgECwTbGFo9R7JYtV0yaDLhf4W3GaMvQz3zaorngo4kchg2squmQaRh8CmQFgc8REzsSd73hQQqcITvu-2FPo4fkaqvg6oNganhCDj9A83zzVOBQIdDc0a-2Bu4bVsjtFlyjIZ9nNKilzQUT2lRvJ0U2tg_ocXPu8ngYb3n-2B-2FjZl0iYTw56NZsyJDsw9z1rJhf7-2FW61-2FrhXoTQ0uusGUzLk9cWYIygvgSe5WZIZF1bZLMyM9dIX3mO6D1uzwuDmUeaKDV-2ByPrEmP-2Fg5Bur8tkehN2cHSG0c2yBiiTRq1W70BFHPUZVjhqHSZ-2BUMenM81qasfvgrF9hHYudFfx8JVAW3aT9GtbAMlLX2oZ-2FYxzLNXVpylv-2FfjMe7Ob8cXcm9mFHMSxSQXukUN7ZTBzq2-2BaNuc8X2m8w0Jc9yeWEkuO958PnjUQbbc5W3lEM9Ke1PGWqgDc7FKwGhIc4CCI2gGWBU3fMQ HTTP 302
    https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcheHyELy2cIe9ABAnNd7Mcq-2BgbgsD6qMaV-2BrqWuxx2aQIcDHt-2B9REAEtzHQ9zwuBGA-3D-3D_bkU_rpS3LQWQtA9VbqDkxHrc1A2vTQ6flmUuL2huajXJ3cbPZaGVGY1wAaSdYT7Cbcb7DKGPvDIhC4cp-2FE5v6W9008wJXZhqpHm2fuUz20czyUfMoNZdQdyw4iNwat1CbDDyvNsaSYsLKjI9LivN4GVc5TuGoGUBqvdP0vW4UTxdl783VwrzSM3WpkjeX-2FxqUOBo6y0XkU8nWSiY6-2BfISjmEnOk6NAHHV2b8A7bl26WHZj8A7E3rEpl8FlpGNpTlua1S7VVQIuA0EshvacJjfJ8jCsHwvl4ZTIpmPNQlnoczMbdZBInRdXL2i4C9pP8t-2FhGlIj7frh2ejP5AZN5eLJuWCg-3D-3D HTTP 302
    https://0ed59bc.wcomhost.com/postede/pst/ HTTP 302
    https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99 HTTP 301
    http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/ HTTP 307
    https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/ Page URL
  2. https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients HTTP 301
    http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/ HTTP 307
    https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxctTqnu0lVlcJIW-2FgiyV5hJl4hfIM5ynS5yvoOMphr0QNBv-2BB8-2F6v0-2BEJMSgsa2XkoSMd5s9g4SXb1X410fzb8qnShfLaSOicdXo-2Fw9qhxmrDkWdxd2yVP7rfRtkjbZFcytbbR3INIP0s1LNoK-2BGWfUcM-2BbUf0Fu9jhqae755IPhJ3QfKLlhWO0K8CddUj1-2BkKkpgbIjjSHLpRxaY-2BgZlm-2B006U4moCwn1S7wMxryDB1sU5cbut7TWM1Rwm5sxE2yKvYhfGujPzw0U3xh-2BDypEfmu1M2cK-2BRQa8oCB6PxL-2BEKRAs0iF9S9T7F62syGmDkGixp1mS0ReOSoAilq3W9tDHQiDVSYFqQr5JIxeqlMyRdm7mpoOYFmPv1V4SG0NGtZQBs4L7c1La5GcclOEahZskgb0EH2tBE66jcj6FTXeBhZwiIicdoa59-2BLK21e40GrDJ-2BuusErgX-2BVEHnrQVvwD95Ufwxk-2BYocOXQueuWmVHibQo3TWhJC2Dy6TQ8vmo8vEcIXJBxCWQHZq9FmaDnj-2Ful0OvgECwTbGFo9R7JYtV0yaDLhf4W3GaMvQz3zaorngo4kchg2squmQaRh8CmQFgc8REzsSd73hQQqcITvu-2FPo4fkaqvg6oNganhCDj9A83zzVOBQIdDc0a-2Bu4bVsjtFlyjIZ9nNKilzQUT2lRvJ0U2tg_ocXPu8ngYb3n-2B-2FjZl0iYTw56NZsyJDsw9z1rJhf7-2FW61-2FrhXoTQ0uusGUzLk9cWYIygvgSe5WZIZF1bZLMyM9dIX3mO6D1uzwuDmUeaKDV-2ByPrEmP-2Fg5Bur8tkehN2cHSG0c2yBiiTRq1W70BFHPUZVjhqHSZ-2BUMenM81qasfvgrF9hHYudFfx8JVAW3aT9GtbAMlLX2oZ-2FYxzLNXVpylv-2FfjMe7Ob8cXcm9mFHMSxSQXukUN7ZTBzq2-2BaNuc8X2m8w0Jc9yeWEkuO958PnjUQbbc5W3lEM9Ke1PGWqgDc7FKwGhIc4CCI2gGWBU3fMQ HTTP 302
  • https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcheHyELy2cIe9ABAnNd7Mcq-2BgbgsD6qMaV-2BrqWuxx2aQIcDHt-2B9REAEtzHQ9zwuBGA-3D-3D_bkU_rpS3LQWQtA9VbqDkxHrc1A2vTQ6flmUuL2huajXJ3cbPZaGVGY1wAaSdYT7Cbcb7DKGPvDIhC4cp-2FE5v6W9008wJXZhqpHm2fuUz20czyUfMoNZdQdyw4iNwat1CbDDyvNsaSYsLKjI9LivN4GVc5TuGoGUBqvdP0vW4UTxdl783VwrzSM3WpkjeX-2FxqUOBo6y0XkU8nWSiY6-2BfISjmEnOk6NAHHV2b8A7bl26WHZj8A7E3rEpl8FlpGNpTlua1S7VVQIuA0EshvacJjfJ8jCsHwvl4ZTIpmPNQlnoczMbdZBInRdXL2i4C9pP8t-2FhGlIj7frh2ejP5AZN5eLJuWCg-3D-3D HTTP 302
  • https://0ed59bc.wcomhost.com/postede/pst/ HTTP 302
  • https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99 HTTP 301
  • http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/ HTTP 307
  • https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
Redirect Chain
  • https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxctTqnu0lVlcJIW-2FgiyV5hJl4hfIM5ynS5yvoOMphr0QNBv-2BB8-2F6v0-2BEJMSgsa2XkoSMd5s9g4SXb1X410fzb8qnShfLaSOicdXo-2Fw9qhxmrDkWdxd2yVP7...
  • https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcheHyELy2cIe9ABAnNd7Mcq-2BgbgsD6qMaV-2BrqWuxx2aQIcDHt-2B9REAEtzHQ9zwuBGA-3D-3D_bkU_rpS3LQWQtA9VbqDkxHrc1A2vTQ6flmUuL2huajXJ3cbPZ...
  • https://0ed59bc.wcomhost.com/postede/pst/
  • https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99
  • http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
  • https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
151 B
430 B 		Document
General
Check archive.org
Download Go to
Full URL
https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.188.192.208 Amarillo, United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
vux.netsolhost.com
Software
openresty/1.19.9.1 / PHP/8.0.23
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 13 Apr 2023 22:49:18 GMT
referrer-policy
no-referrer-when-downgrade
server
openresty/1.19.9.1
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
PHP/8.0.23
x-webcom-cache-status
BYPASS
x-xss-protection
"1; mode=block"

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
Non-Authoritative-Reason
HSTS
Primary Request /
0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
Redirect Chain
  • https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients
  • http://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
  • https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
1 MB
608 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
Requested by
Host: 0ed59bc.wcomhost.com
URL: https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.188.192.208 Amarillo, United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
vux.netsolhost.com
Software
openresty/1.19.9.1 / PHP/8.0.23
Resource Hash
039d3f592f13a313b222347d081def6d3e91dc571f445c5a557bf6bc617d9148
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Referer
https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 13 Apr 2023 22:49:20 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
openresty/1.19.9.1
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
PHP/8.0.23
x-webcom-cache-status
BYPASS
x-xss-protection
"1; mode=block"

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://0ed59bc.wcomhost.com/postede/pst/117705c36da32f609e99/clients/
Non-Authoritative-Reason
HSTS
truncated
/ 		243 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d4664dd3d67bd3bbe6653fe5273756db06a66ed9f6b2e3d317a28c5bd04ecb90

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de

Request headers

Referer
Origin
https://0ed59bc.wcomhost.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31

Request headers

Referer
Origin
https://0ed59bc.wcomhost.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		44 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdff80a70c9c788e4c93d02eff684aa381d0f26bf9565edfd1bfdb15c602b4e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

1 Cookies

Domain/Path Name / Value
0ed59bc.wcomhost.com/ Name: PHPSESSID
Value: f774d2d7b7303b6328381d8a5ca240cd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"