![](/screenshots/73a73043-b487-4e92-b07a-55f3729ad92d.png)
secure350.servconfig.com
Open in
urlscan Pro
213.165.242.55
Malicious Activity!
Public Scan
Effective URL: https://secure350.servconfig.com/~a373525/box/
Submission: On May 30 via api from BG — Scanned from GB
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 16th 2024. Valid for: a year.
This is the only time secure350.servconfig.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 93.184.221.165 93.184.221.165 | 15133 (EDGECAST) (EDGECAST) | |
2 | 213.165.242.55 213.165.242.55 | 22611 (INMOTION) (INMOTION) | |
3 | 3 |
ASN22611 (INMOTION, US)
PTR: amsres350.servconfig.com
secure350.servconfig.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
servconfig.com
secure350.servconfig.com |
2 MB |
1 |
t.co
t.co — Cisco Umbrella Rank: 717 |
570 B |
3 | 2 |
Domain | Requested by | |
---|---|---|
2 | secure350.servconfig.com |
t.co
secure350.servconfig.com |
1 | t.co | |
3 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
banking.postbank.de |
www.postbank.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-05-08 - 2025-05-07 |
a year | crt.sh |
*.servconfig.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-16 - 2025-03-11 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://secure350.servconfig.com/~a373525/box/
Frame ID: D060CE30172E50BD8647E5169FE39899
Requests: 8 HTTP requests in this frame
Frame:
https://secure350.servconfig.com/~a373525/box/Postbank%20Banking%20&%20Brokerage.._files/saved_resource.html
Frame ID: E5D4F25FC63516954147743CA022D005
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/73a73043-b487-4e92-b07a-55f3729ad92d.png)
Page URL History Show full URLs
- https://t.co/DNg85a2PA4 Page URL
- https://secure350.servconfig.com/~a373525/box/ Page URL
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Zugangsdaten vergessen?
Search URL Search Domain Scan URL
Title: Zum Postbank Zinssparen
Search URL Search Domain Scan URL
Title: Alles Wichtige zum Online-Banking
Search URL Search Domain Scan URL
Title: Informationen für Privatkunden
Search URL Search Domain Scan URL
Title: Informationen für Geschäftskunden
Search URL Search Domain Scan URL
Title: Postbank ID einrichten
Search URL Search Domain Scan URL
Title: Zu den aktuellen Sicherheitshinweisen
Search URL Search Domain Scan URL
Title: Erste Schritte
Search URL Search Domain Scan URL
Title: Terminvereinbarung
Search URL Search Domain Scan URL
Title: Kontakt
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: Rechtshinweise
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/DNg85a2PA4 Page URL
- https://secure350.servconfig.com/~a373525/box/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
DNg85a2PA4
t.co/ |
295 B 570 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
secure350.servconfig.com/~a373525/box/ |
2 MB 2 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
247 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
243 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saved_resource.html
secure350.servconfig.com/~a373525/box/Postbank%20Banking%20&%20Brokerage.._files/ Frame E5D4 |
483 B 560 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| savepage_ShadowLoader1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 374c0b15-6b7c-4a7b-9880-7ca0c426254a |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure350.servconfig.com
t.co
213.165.242.55
93.184.221.165
02e6dbdfca6b937ecdfc58243416e028997733e6df871ce833fee5c10c96657b
07d6126a6cf6fd69aa3604dab020b277f4f1d470007865bf8d2dbfcae2f8711e
12164efcaf829ad24ff7a8367cdcd40dde1d4c23d437d28d791617a8827d7115
3ab65524380fa9267bbcf2d4df64def918baeeaf4df69a2d58026d2149b68d96
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
817881650ee0edc8d2f2de7be553daf45fd424c92b580da50bafe12dab611866
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de