home-login-postfinance.on.drv.tw
Open in
urlscan Pro
47.251.69.173
Malicious Activity!
Public Scan
Effective URL: https://home-login-postfinance.on.drv.tw/mein/home.html
Submission: On April 10 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 5th 2024. Valid for: 3 months.
This is the only time home-login-postfinance.on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostFinance (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 9 | 47.251.69.173 47.251.69.173 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 147.50.231.65 147.50.231.65 | 9891 (CSLOX-IDC...) (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.) | |
1 | 20.50.153.39 20.50.153.39 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
3 | 2a00:1450:400... 2a00:1450:4001:828::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2600:9000:20c... 2600:9000:20c3:6600:5:6c74:c540:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:802::200e | 15169 (GOOGLE) (GOOGLE) | |
4 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:400c:c0d::9b | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:82b::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::2001 | 15169 (GOOGLE) (GOOGLE) | |
24 | 12 |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
home-login-postfinance.on.drv.tw |
ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: killadds.co.uk
farmchokchai.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
region1.google-analytics.com | |
region1.analytics.google.com |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
drv.tw
4 redirects
home-login-postfinance.on.drv.tw www.drv.tw cdn-of.drv.tw |
448 KB |
4 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 99 region1.google-analytics.com — Cisco Umbrella Rank: 1879 |
21 KB |
3 |
google.com
1 redirects
region1.analytics.google.com — Cisco Umbrella Rank: 2227 drive.google.com — Cisco Umbrella Rank: 803 |
2 KB |
3 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 114 |
242 KB |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 195 |
414 B |
1 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 109 |
784 B |
1 |
google.de
www.google.de — Cisco Umbrella Rank: 4622 |
63 B |
1 |
farmchokchai.com
farmchokchai.com |
3 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1217 |
30 KB |
0 |
jkdluxlimo.com
Failed
jkdluxlimo.com Failed |
|
24 | 10 |
Domain | Requested by | |
---|---|---|
9 | home-login-postfinance.on.drv.tw |
4 redirects
home-login-postfinance.on.drv.tw
|
3 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | region1.analytics.google.com |
www.googletagmanager.com
|
2 | region1.google-analytics.com |
www.googletagmanager.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | cdn-of.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | lh3.googleusercontent.com | |
1 | drive.google.com | 1 redirects |
1 | www.google.de |
home-login-postfinance.on.drv.tw
|
1 | www.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | farmchokchai.com |
home-login-postfinance.on.drv.tw
|
1 | code.jquery.com |
home-login-postfinance.on.drv.tw
|
0 | jkdluxlimo.com Failed |
code.jquery.com
|
24 | 14 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2024-03-05 - 2024-06-03 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
farmchokchai.com R3 |
2024-03-22 - 2024-06-20 |
3 months | crt.sh |
www.drv.tw GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2023-12-18 - 2024-06-18 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://home-login-postfinance.on.drv.tw/mein/home.html
Frame ID: 6DF27CDBC2B952C20BC86C2C35BA8973
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
PostFinance - E-FinancePage URL History Show full URLs
-
http://home-login-postfinance.on.drv.tw/mein/home.html
HTTP 307
https://home-login-postfinance.on.drv.tw/mein/home.html HTTP 307
http://home-login-postfinance.on.drv.tw/mein/home.html HTTP 307
https://home-login-postfinance.on.drv.tw/mein/home.html Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://home-login-postfinance.on.drv.tw/mein/home.html
HTTP 307
https://home-login-postfinance.on.drv.tw/mein/home.html HTTP 307
http://home-login-postfinance.on.drv.tw/mein/home.html HTTP 307
https://home-login-postfinance.on.drv.tw/mein/home.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW06-Light.23770ae90a0ac3d5.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b?ra=4710ATBV-RRp8ubeu4Htoa3h6niM2XGHQFSARAS4dAKYgCaEJVQaLj5KNlHbG2A3bH3qWC45fQe7HaAnE0LROQfGkv9DUqLTrJ3a_qmJVs_wkEmp6IBV4qcY6vbJa9sQwPzomuXKo0QuUCqCeJi7qH6cySxF8FiU_KKc4KztROudd82Kccov2-xPKSGqAfnMrh3YunMOdQwjFr4_3N25dA0a.92ay
- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW05-Medium.58a0ff866e7c76b1.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH?ra=4710ATBV-RRp8ubeu4Htoa3h6niM2XGHQFSARAS4dAKYgCaEJVQaLj5KNlHbG2A3bH3qWC45fQe7HaAnE0LROQfGkv9DUqLTrJ3a_qmJVs_wkEmp6IBV4qcY6vbJa9sQwPzomuXKo0QuUCqCeJi7qH6cySxF8FiU_KKc4KztROudd82Kccov2-xPKSGqAfnMrh3YunMOdQwjFr4_3N25dA0a.92ay
- https://home-login-postfinance.on.drv.tw/mein/log_files/favicon.ico HTTP 302
- https://drive.google.com/thumbnail?sz=w1000&id=1sdymtCmcA_rfPMIrz_ipPMIEnrFDf6fK HTTP 302
- https://lh3.googleusercontent.com/d/1sdymtCmcA_rfPMIrz_ipPMIEnrFDf6fK=w1000
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.html
home-login-postfinance.on.drv.tw/mein/ Redirect Chain
|
143 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.f88b886e8d70eb8b.css
home-login-postfinance.on.drv.tw/mein/log_files/ |
202 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.ccs.js
farmchokchai.com/home/mein/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 841 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.9e673858d384d2a88ba2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
61 KB 14 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other.baa9f8e29ae4e29778d2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
13 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.ce995d22237219656e3a.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
1 MB 281 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
142 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
42 KB 43 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
41 KB 42 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
file.php
jkdluxlimo.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
237 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
307 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 257 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 266 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 56 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ga-audiences
www.google.de/ads/ |
42 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 219 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 358 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1sdymtCmcA_rfPMIrz_ipPMIEnrFDf6fK=w1000
lh3.googleusercontent.com/d/ Redirect Chain
|
479 B 784 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
region1.google-analytics.com/g/ |
0 17 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jkdluxlimo.com
- URL
- https://jkdluxlimo.com/file.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostFinance (Banking)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| base_url string| chat_id function| checkStatus function| cleanUp function| validate function| formatString function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
home-login-postfinance.on.drv.tw/ | Name: uid Value: rBI/+2YWaydh3W1QNSdRAg== |
|
.drv.tw/ | Name: _ga_LHL0SH0Z7S Value: GS1.1.1712745259.1.0.1712745259.60.0.0 |
|
.drv.tw/ | Name: _ga Value: GA1.2.388727153.1712745259 |
|
.drv.tw/ | Name: _gid Value: GA1.2.1930190640.1712745259 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1712745259.1.0.1712745262.0.0.0 |
|
.google.com/ | Name: NID Value: 513=RSFggerDpdXhVWDKilsk1is7KFXIDM7ffx4XVNClq7_A_N3aaulQBccztqksqpNKD21mPApSNmqMFBH42YZ2nndjfs6h3nWU8UHhDRlrcHkYfo34HSIjtk_FjogVfwrfZZWWmZ20hZoCes4UW5jUdHCCoxOYejGu1fXtWOpad98 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-of.drv.tw
code.jquery.com
drive.google.com
farmchokchai.com
home-login-postfinance.on.drv.tw
jkdluxlimo.com
lh3.googleusercontent.com
region1.analytics.google.com
region1.google-analytics.com
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.google.de
www.googletagmanager.com
jkdluxlimo.com
147.50.231.65
20.50.153.39
2001:4860:4802:34::36
2600:9000:20c3:6600:5:6c74:c540:93a1
2a00:1450:4001:802::200e
2a00:1450:4001:81c::2001
2a00:1450:4001:827::2003
2a00:1450:4001:828::2008
2a00:1450:4001:82b::200e
2a00:1450:400c:c0d::9b
2a04:4e42:400::649
47.251.69.173
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
112bcad73efdf6400a78ed0b6ecf7afac7a43f2467a228848b941725526c9e53
1f36ed77df4925dfdd69129329b51cb52991fb97d9203faa34b60e76d76b8ab2
36468d7978ef11b2f74e03b789af70980e839aff47b9336f867aedeca554688c
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cd0831888af056208066accccd9de5470925b62abd26b87dd672eeb72975f26
945b7abfd79a70e0a31c7b911b98f750e33dedf1e5c4769cbd1813198f789dcc
9e3c106724b88a584f5510a4ec193bfc8930a976236617f50c023e6a5ca7eb38
b29d78af84f7084b9b1b1ed17c40da3454e9e5b4374156cd3ccc2b36bcc67ed7
b5f1a139e80b358d136b5b4b1b3e4b8a73bafe2c0f3f675675e4346c269ccfad
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079
d57f0454f106eff11c18b45792a1be05ca0cd79ea653a201a37939e8235eff73
ddcf221f9ba32ec5d0bd05ad2207e370e7d399e7dd348ea1fee2c0e7c1135c0d
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea973ba7beb8f95ee114ab45a171b0e0ddc50ba57932183de17c4449809cb818
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629