www.bertapan.ch
Open in
urlscan Pro
88.99.148.196
Malicious Activity!
Public Scan
Effective URL: https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/login/
Submission: On August 06 via automatic, source openphish
Summary
TLS certificate: Issued by R3 on August 4th 2021. Valid for: 3 months.
This is the only time www.bertapan.ch was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 51.11.245.243 51.11.245.243 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 161.97.134.239 161.97.134.239 | 51167 (CONTABO) (CONTABO) | |
2 27 | 88.99.148.196 88.99.148.196 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 151.101.12.193 151.101.12.193 | 54113 (FASTLY) (FASTLY) | |
27 | 3 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com |
ASN51167 (CONTABO, DE)
PTR: vmi562964.contaboserver.net
iemstracking.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
bertapan.ch
2 redirects
www.bertapan.ch |
2 MB |
2 |
beminannao9fxwpm64ma4neidvoll.com
1 redirects
kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com |
632 B |
1 |
imgur.com
i.imgur.com |
10 KB |
1 |
iemstracking.com
1 redirects
iemstracking.com |
321 B |
27 | 4 |
Domain | Requested by | |
---|---|---|
27 | www.bertapan.ch |
2 redirects
kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com
www.bertapan.ch |
2 | kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com | 1 redirects |
1 | i.imgur.com | |
1 | iemstracking.com | 1 redirects |
27 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bertapan.ch R3 |
2021-08-04 - 2021-11-02 |
3 months | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/login/
Frame ID: 3ADFB6DBEC142646B1B77E14246B6B6D
Requests: 27 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com/rd/c429pniec717393zdkk412wmq10301cnvw144 Page URL
-
http://kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com/track/c429pniec717393zdkk412wmq10301cnvw144
HTTP 302
https://iemstracking.com/click.php?IE=lce4wmvl5ow80urk77hm&mailer={mailer}&client={client}&user=7&cam... HTTP 302
https://www.bertapan.ch/home/PSTBN/ Page URL
-
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95
HTTP 301
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/ HTTP 302
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/login/ Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- script /angular.*\.js/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com/rd/c429pniec717393zdkk412wmq10301cnvw144 Page URL
-
http://kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com/track/c429pniec717393zdkk412wmq10301cnvw144
HTTP 302
https://iemstracking.com/click.php?IE=lce4wmvl5ow80urk77hm&mailer={mailer}&client={client}&user=7&campaign=429&list=717393&email=412&interface=10301 HTTP 302
https://www.bertapan.ch/home/PSTBN/ Page URL
-
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95
HTTP 301
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/ HTTP 302
https://www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com/track/c429pniec717393zdkk412wmq10301cnvw144 HTTP 302
- https://iemstracking.com/click.php?IE=lce4wmvl5ow80urk77hm&mailer={mailer}&client={client}&user=7&campaign=429&list=717393&email=412&interface=10301 HTTP 302
- https://www.bertapan.ch/home/PSTBN/
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
c429pniec717393zdkk412wmq10301cnvw144
kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com/rd/ |
235 B 352 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.bertapan.ch/home/PSTBN/ Redirect Chain
|
728 B 636 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95/login/ Redirect Chain
|
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
www.bertapan.ch/home/PSTBN/bower_components/jquery/dist/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ua-parser.min.js
www.bertapan.ch/home/PSTBN/bower_components/ua-parser-js/dist/ |
17 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
www.bertapan.ch/home/PSTBN/bower_components/font-awesome/css/ |
30 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core_form.js
www.bertapan.ch/home/PSTBN/core/form/ |
15 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core_form.css
www.bertapan.ch/home/PSTBN/core/form/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core_token.js
www.bertapan.ch/home/PSTBN/core/token/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
www.bertapan.ch/home/PSTBN/bower_components/angular/ |
165 KB 165 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
www.bertapan.ch/home/PSTBN/login/form/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
www.bertapan.ch/home/PSTBN/login/ |
214 KB 215 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.js
www.bertapan.ch/home/PSTBN/login/form/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ng.js
www.bertapan.ch/home/PSTBN/login/ng/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
token.js
www.bertapan.ch/home/PSTBN/login/token/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
www.bertapan.ch/home/PSTBN/login/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-claim.svg
www.bertapan.ch/home/PSTBN/login/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iob5_login_alte_anmeldung.jpg
www.bertapan.ch/home/PSTBN/login/ |
15 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iob_5_login_psd2.jpg
www.bertapan.ch/home/PSTBN/login/ |
207 KB 207 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iob_5_sicherheitshinweis.jpg
www.bertapan.ch/home/PSTBN/login/ |
186 KB 187 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
newloader.gif
www.bertapan.ch/home/PSTBN/ |
544 KB 545 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Uy8gvIY.png
i.imgur.com/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home.php
www.bertapan.ch/home/PSTBN/ |
58 B 177 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home.php
www.bertapan.ch/home/PSTBN/ |
58 B 177 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frutigerltw02-55roman.woff2
www.bertapan.ch/home/PSTBN/login/ |
48 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frutigerltw02-65bold.woff2
www.bertapan.ch/home/PSTBN/login/ |
41 KB 41 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home.php
www.bertapan.ch/home/PSTBN/ |
58 B 177 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)53 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| UAParser function| ask_pass_proxy function| ask_user_proxy function| ask_show_bs_form_proxy function| ask_def_proxy function| ask_confirm_proxy function| ask_mobile_tan_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular object| _0xa211 function| _kaktys_encode string| bid object| php_js object| app string| el object| CORE__ object| REST_FN__ object| sc_ object| loader_ number| bidder_timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.bertapan.ch/home/PSTBN | Name: real Value: OK |
|
www.bertapan.ch/home/PSTBN/a1b2c3/8130a029b383be01f15b659987deab95 | Name: bid Value: 8130a029b383be01f15b659987deab95 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
i.imgur.com
iemstracking.com
kyr38zvp31itwdad7hahex55w79cwocolp6t486i.beminannao9fxwpm64ma4neidvoll.com
www.bertapan.ch
151.101.12.193
161.97.134.239
51.11.245.243
88.99.148.196
0017a0ec297bd5f536253c452efe2c4f687d765f8a896b0ee95a6dfffe0fb99a
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
1ad849d8a916dcde00adb1ee3d0f21c7f636a98b7b2c49f57194f245d37b2e91
1e5ba89f017d03470b0e88e65dc75a80ba05212e159a0f0fb2347881edf6608d
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20
550778f7050b2f39fc38c8e326c78e0a53921774f9f39dd3685f1c73efee2613
582065fc7e084249c1677034ff40a1f2cf7279620ce15d0d6b6cba6becd65427
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
847b62572ed6998893449d7b8858d8bac034e6111ae8225922b1316f59c8fd80
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8f49bc9b4670e94d5ccfbe9b8279802d3b3dd3d8272bb01ba570119e795a4c93
9459cfdaef9d197d1f48a2190e65dff33a3906fc7f98f6c28bcad7478c30ef47
946660bb68994bd9480fd5822b55ebd2907bcf76927305e84f47c20431568789
958bac3fee20e15e22ef42677505deb90d74e7214d66a20a160a03d8c10795ad
96473ac90957af87da5dedfd4f58c79a165e67676c71f0bc4b93d94d30d831ba
9a0d00c665d412af313e93ebf65fed473a5a0fa79190c1cf739c22c88a8a8a43
a14c0795d3c8aa995526096002771398d1c43837b5935beeebcb460e4406296a
bac93d28ce07bf63ce8988742ccb6278d74030e4c2be8b318b120463977489e1
c93125f7e4a96e8a97ed83fb3c3c06153d1921ab71778485c0f299e45c3ea2a5
e46f3127e1d2d73084efc503b86c3c5ab7091677b493e10d59f0cf4375b9a1e7
f3940808c63643614ba0b2677b927f8e3a60d9769da9e306e824453df36d658a
f4d43829a46aca95eff47f13325a06f22c5c8c981cbe102d471508241446c581