tawfiles.wpengine.com Open in urlscan Pro
104.196.32.235  Malicious Activity! Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request pass.php Show response tawfiles.wpengine.com/ID/	396 KB 53 KB	233ms 111ms	Document text/html	104.196.32.235 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL http://tawfiles.wpengine.com/ID/pass.php Protocol HTTP/1.1 Server 104.196.32.235 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 235.32.196.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 40b5cc19c3a38808a65e84a663520c0df3e3d95697e9969c4e3af7e6f4400c5d Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control max-age=600, must-revalidate Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 21 Jun 2023 16:24:33 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=20 Pragma no-cache Server nginx Transfer-Encoding chunked Vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie X-Cache HIT: 8 X-Cache-Group normal X-Cacheable SHORT X-Powered-By WP Engine
GET H/1.1	200 OK	logo.svg meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/	3 KB 3 KB	116ms 16ms	Image image/svg+xml	185.157.34.21 DEUBA-NET Germany
General Check archive.org Show headers Download Go to Show image Full URL https://meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/logo.svg Requested by Host: tawfiles.wpengine.com URL: http://tawfiles.wpengine.com/ID/pass.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.157.34.21 , Germany, ASN8373 (DEUBA-NET Germany, DE), Reverse DNS Software Apache / Resource Hash 44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20 Security Headers Name Value Content-Security-Policy default-src 'self'; connect-src 'self' https://bankapi-public.postbank.de https://bankapi.postbank.de https://smoke-api.postbank.de https://smoke-api-public.postbank.de https://www.postbank.de https://collect.tealiumiq.com https://collect-eu-central-1.tealiumiq.com https://visitor-service-eu-central-1.tealiumiq.com https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu; img-src 'self' https://www.postbank.de https://tp.postbank.de https://meine.postbank.de https://smoke-meine.postbank.de https://anlagemanager.postbank.de https://smoke-anlagemanager.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://*.usercentrics.eu data: blob:; script-src 'self' https://pb.media01.eu https://tags.tiqcdn.com https://www.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org 'unsafe-inline' Strict-Transport-Security max-age=63072000; includeSubdomains; preload; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer http://tawfiles.wpengine.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Wed, 21 Jun 2023 16:24:33 GMT Content-Security-Policy default-src 'self'; connect-src 'self' https://bankapi-public.postbank.de https://bankapi.postbank.de https://smoke-api.postbank.de https://smoke-api-public.postbank.de https://www.postbank.de https://collect.tealiumiq.com https://collect-eu-central-1.tealiumiq.com https://visitor-service-eu-central-1.tealiumiq.com https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu; img-src 'self' https://www.postbank.de https://tp.postbank.de https://meine.postbank.de https://smoke-meine.postbank.de https://anlagemanager.postbank.de https://smoke-anlagemanager.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://*.usercentrics.eu data: blob:; script-src 'self' https://pb.media01.eu https://tags.tiqcdn.com https://www.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org 'unsafe-inline' X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubdomains; preload; Content-Encoding gzip Connection Keep-Alive Content-Length 1384 X-XSS-Protection 1; mode=block Referrer-Policy origin Last-Modified Thu, 16 Feb 2023 08:44:38 GMT Server Apache ETag "568-5f4cd34fca980" X-Frame-Options deny Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control private, max-age=15552000, must-revalidate Accept-Ranges bytes Access-Control-Allow-Headers authorization Keep-Alive timeout=10, max=28 Expires Mon, 18 Dec 2023 16:24:33 GMT
GET H/1.1	200 OK	logo-claim.svg meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/	3 KB 3 KB	117ms 18ms	Image image/svg+xml	185.157.34.21 DEUBA-NET Germany
General Check archive.org Show headers Download Go to Show image Full URL https://meine.postbank.de/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/logo-claim.svg Requested by Host: tawfiles.wpengine.com URL: http://tawfiles.wpengine.com/ID/pass.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.157.34.21 , Germany, ASN8373 (DEUBA-NET Germany, DE), Reverse DNS Software Apache / Resource Hash fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b Security Headers Name Value Content-Security-Policy default-src 'self'; connect-src 'self' https://bankapi-public.postbank.de https://bankapi.postbank.de https://smoke-api.postbank.de https://smoke-api-public.postbank.de https://www.postbank.de https://collect.tealiumiq.com https://collect-eu-central-1.tealiumiq.com https://visitor-service-eu-central-1.tealiumiq.com https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu; img-src 'self' https://www.postbank.de https://tp.postbank.de https://meine.postbank.de https://smoke-meine.postbank.de https://anlagemanager.postbank.de https://smoke-anlagemanager.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://*.usercentrics.eu data: blob:; script-src 'self' https://pb.media01.eu https://tags.tiqcdn.com https://www.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org 'unsafe-inline' Strict-Transport-Security max-age=63072000; includeSubdomains; preload; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer http://tawfiles.wpengine.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Wed, 21 Jun 2023 16:24:33 GMT Content-Security-Policy default-src 'self'; connect-src 'self' https://bankapi-public.postbank.de https://bankapi.postbank.de https://smoke-api.postbank.de https://smoke-api-public.postbank.de https://www.postbank.de https://collect.tealiumiq.com https://collect-eu-central-1.tealiumiq.com https://visitor-service-eu-central-1.tealiumiq.com https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu; img-src 'self' https://www.postbank.de https://tp.postbank.de https://meine.postbank.de https://smoke-meine.postbank.de https://anlagemanager.postbank.de https://smoke-anlagemanager.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://*.usercentrics.eu data: blob:; script-src 'self' https://pb.media01.eu https://tags.tiqcdn.com https://www.postbank.de https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org https://assets.adobedtm.com https://*.usercentrics.eu 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://delivery.1tag.dentsu.de https://cdn.1tag.dentsu.de https://dan.mgr.consensu.org https://cdn.dan.mgr.consensu.org 'unsafe-inline' X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubdomains; preload; Content-Encoding gzip Connection Keep-Alive Content-Length 1277 X-XSS-Protection 1; mode=block Referrer-Policy origin Last-Modified Thu, 16 Feb 2023 08:44:38 GMT Server Apache ETag "4fd-5f4cd34fca980" X-Frame-Options deny Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control private, max-age=15552000, must-revalidate Accept-Ranges bytes Access-Control-Allow-Headers authorization Keep-Alive timeout=10, max=89 Expires Mon, 18 Dec 2023 16:24:33 GMT
GET DATA	200 OK	truncated /	1016 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920 Request headers accept-language de-DE,de;q=0.9 Referer http://tawfiles.wpengine.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	404 Not Found	svg-icon-sprite.svg tawfiles.wpengine.com/ID/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/	0 0	105ms 104ms	Other text/html	104.196.32.235 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL http://tawfiles.wpengine.com/ID/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg Requested by Host: tawfiles.wpengine.com URL: http://tawfiles.wpengine.com/ID/pass.php Protocol HTTP/1.1 Server 104.196.32.235 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 235.32.196.104.bc.googleusercontent.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://tawfiles.wpengine.com/ID/pass.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Wed, 21 Jun 2023 16:24:33 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Vary Accept-Encoding, Accept-Encoding Content-Type text/html Connection keep-alive Keep-Alive timeout=20
GET H/1.1	200 OK	FrutigerLTW02-55Roman.woff2 tawfiles.wpengine.com/ID/	48 KB 49 KB	206ms 104ms	Font font/woff2	104.196.32.235 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL http://tawfiles.wpengine.com/ID/FrutigerLTW02-55Roman.woff2 Requested by Host: tawfiles.wpengine.com URL: http://tawfiles.wpengine.com/ID/pass.php Protocol HTTP/1.1 Server 104.196.32.235 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 235.32.196.104.bc.googleusercontent.com Software nginx / Resource Hash 0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c Request headers Referer http://tawfiles.wpengine.com/ID/pass.php Origin http://tawfiles.wpengine.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Wed, 21 Jun 2023 16:24:33 GMT Last-Modified Thu, 15 Jun 2023 13:55:32 GMT Server nginx ETag "648b1854-c0dc" Vary Accept-Encoding Content-Type font/woff2 Access-Control-Allow-Origin * Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=20 Content-Length 49372
GET H/1.1	200 OK	FrutigerLTW02-65Bold.woff2 tawfiles.wpengine.com/ID/	41 KB 41 KB	205ms 104ms	Font font/woff2	104.196.32.235 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL http://tawfiles.wpengine.com/ID/FrutigerLTW02-65Bold.woff2 Requested by Host: tawfiles.wpengine.com URL: http://tawfiles.wpengine.com/ID/pass.php Protocol HTTP/1.1 Server 104.196.32.235 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 235.32.196.104.bc.googleusercontent.com Software nginx / Resource Hash 33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d Request headers Referer http://tawfiles.wpengine.com/ID/pass.php Origin http://tawfiles.wpengine.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Wed, 21 Jun 2023 16:24:33 GMT Last-Modified Thu, 15 Jun 2023 13:55:32 GMT Server nginx ETag "648b1854-a418" Vary Accept-Encoding Content-Type font/woff2 Access-Control-Allow-Origin * Cache-Control public, max-age=31536000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=20 Content-Length 42008

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| Close

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://tawfiles.wpengine.com/ID/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg#icon-cross Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

meine.postbank.de
tawfiles.wpengine.com
104.196.32.235
185.157.34.21
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d
40b5cc19c3a38808a65e84a663520c0df3e3d95697e9969c4e3af7e6f4400c5d
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b