app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com Open in urlscan Pro
51.103.212.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://redigermanylagouyeouter.blob.core.windows.net/manous/putty.html
Effective URL:
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/
Submission: On March 07 via manual (March 7th 2023, 9:46:16 am UTC) from DE — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 51.103.212.1, located in Zurich, Switzerland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com.

This is the only time app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	52.239.170.68 52.239.170.68	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	172.98.64.231 172.98.64.231	46562 (PERFORMIVE) (PERFORMIVE)
1 13	51.103.212.1 51.103.212.1	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
14	3

1 52.239.170.68 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

redigermanylagouyeouter.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.98.64.231 (Montreal, Canada) 1 redirects

ASN46562 (PERFORMIVE, US)
PTR: securewineshop.com

www.securewineshop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 51.103.212.1 (Zurich, Switzerland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	azure.com 1 redirects app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com	2 MB
2	securewineshop.com 1 redirects www.securewineshop.com	679 B
1	windows.net redigermanylagouyeouter.blob.core.windows.net	542 B
14	3

	Domain	Requested by
13	app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com	1 redirects www.securewineshop.com app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com
2	www.securewineshop.com	1 redirects redigermanylagouyeouter.blob.core.windows.net
1	redigermanylagouyeouter.blob.core.windows.net
14	3

This site contains no links.

Subject Issuer	Validity	Valid
*.blob.core.windows.net Microsoft RSA TLS CA 02	`2022-12-21` - `2023-12-21`	a year	crt.sh
www.securewineshop.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-12-29` - `2023-12-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/
Frame ID: 81F55F19A551428E64CD03F54EDAD5A7
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

https://redigermanylagouyeouter.blob.core.windows.net/manous/putty.html Page URL
https://www.securewineshop.com//hamiltoncellars/provider/terl/idsca2/bins.html Page URL
https://www.securewineshop.com/hamiltoncellars/provider/terl/isdca1/ifpsm.php HTTP 302
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/ Page URL
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients HTTP 301
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

14 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1885 kB
Transfer

1882 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://redigermanylagouyeouter.blob.core.windows.net/manous/putty.html Page URL
https://www.securewineshop.com//hamiltoncellars/provider/terl/idsca2/bins.html Page URL
https://www.securewineshop.com/hamiltoncellars/provider/terl/isdca1/ifpsm.php HTTP 302
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/ Page URL
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients HTTP 301
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://www.securewineshop.com/hamiltoncellars/provider/terl/isdca1/ifpsm.php HTTP 302
http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	putty.html redigermanylagouyeouter.blob.core.windows.net/manous/	139 B 542 B	612ms 164ms	Document text/html	52.239.170.68 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://redigermanylagouyeouter.blob.core.windows.net/manous/putty.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.239.170.68 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Content-Length 139 Content-MD5 bu461RsAWXqfSjKwOvKFiA== Content-Type text/html Date Tue, 07 Mar 2023 09:46:07 GMT ETag 0x8DB1CBAA362AB7D Last-Modified Sat, 04 Mar 2023 14:13:33 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-blob-type BlockBlob x-ms-lease-status unlocked x-ms-request-id 91b9bc66-b01e-00a8-18d9-507e50000000 x-ms-version 2009-09-19
GET H/1.1	200 OK	bins.html www.securewineshop.com//hamiltoncellars/provider/terl/idsca2/	138 B 380 B	1750ms 162ms	Document text/html	172.98.64.231 PERFORMIVE
General Check archive.org Show headers Download Go to Full URL https://www.securewineshop.com//hamiltoncellars/provider/terl/idsca2/bins.html Requested by Host: redigermanylagouyeouter.blob.core.windows.net URL: https://redigermanylagouyeouter.blob.core.windows.net/manous/putty.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.98.64.231 Montreal, Canada, ASN46562 (PERFORMIVE, US), Reverse DNS securewineshop.com Software Apache / Resource Hash Request headers Referer https://redigermanylagouyeouter.blob.core.windows.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 138 Content-Type text/html Date Tue, 07 Mar 2023 09:46:09 GMT Keep-Alive timeout=2, max=100 Last-Modified Fri, 17 Feb 2023 22:26:10 GMT Server Apache
GET H/1.1	200 OK	/ app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/ Redirect Chain https://www.securewineshop.com/hamiltoncellars/provider/terl/isdca1/ifpsm.php http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/	151 B 321 B	136ms 30ms	Document text/html	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/ Requested by Host: www.securewineshop.com URL: https://www.securewineshop.com//hamiltoncellars/provider/terl/idsca2/bins.html Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / PHP/5.6.31 Resource Hash Request headers Referer https://www.securewineshop.com//hamiltoncellars/provider/terl/idsca2/bins.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Content-Length 151 Content-Type text/html; charset=UTF-8 Date Tue, 07 Mar 2023 09:46:06 GMT Server Microsoft-IIS/8.0 X-Powered-By PHP/5.6.31 Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 07 Mar 2023 09:46:10 GMT Keep-Alive timeout=2, max=99 Server Apache Transfer-Encoding chunked location http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/
GET H/1.1	200 OK	Primary Request / Show response app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Redirect Chain http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/	1 KB 2 KB	32ms 32ms	Document text/html	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / PHP/5.6.31 Resource Hash `17e3aef8ea7ce8da06a44d59724748c6b9e389942a0c581bd82a45dad7f0f41e` Request headers Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 1291 Content-Type text/html; charset=UTF-8 Date Tue, 07 Mar 2023 09:46:06 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server Microsoft-IIS/8.0 X-Powered-By PHP/5.6.31 Redirect headers Content-Length 208 Content-Type text/html; charset=UTF-8 Date Tue, 07 Mar 2023 09:46:06 GMT Location http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Server Microsoft-IIS/8.0
GET H/1.1	200 OK	main.css app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/css/	50 KB 50 KB	30ms 30ms	Stylesheet text/css	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/css/main.css Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `98f8b4b01ebae4460dd4c9b90a9c3a623f5263bfc51bcc3c8926ca3d4b8e9bdc` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:12 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "08090eecdfdd81:0" Content-Length 50893 Content-Type text/css
GET H/1.1	200 OK	bootstrap.min.css app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/css/	201 KB 202 KB	61ms 32ms	Stylesheet text/css	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/css/bootstrap.min.css Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `ed32594ab88d0b8594b1978ff2cb2489ae234186e9e3d6c404731aa04fe20abd` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:12 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "08090eecdfdd81:0" Content-Length 206130 Content-Type text/css
GET H/1.1	200 OK	background.svg app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/images/	3 KB 3 KB	30ms 30ms	Image image/svg+xml	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/images/background.svg Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:14 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "0adc1efcdfdd81:0" Content-Length 2565 Content-Type image/svg+xml
GET H/1.1	200 OK	jquery.min.js Show response app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/js/	91 KB 91 KB	59ms 30ms	Script application/javascript	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/js/jquery.min.js Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:10 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "0535fedcdfdd81:0" Content-Length 93100 Content-Type application/javascript
GET H/1.1	200 OK	jquery.min.js Show response app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/js/	86 KB 86 KB	61ms 32ms	Script application/javascript	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/js/jquery.min.js Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:18 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "0724f2cdfdd81:0" Content-Length 88144 Content-Type application/javascript
GET H/1.1	404 Not Found	popper.min.js app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/js/	0 0	62ms 33ms	Script text/html	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/js/popper.min.js Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Server Microsoft-IIS/8.0 Content-Length 1245 Content-Type text/html
GET H/1.1	200 OK	main.js Show response app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/	7 KB 7 KB	61ms 32ms	Script application/javascript	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/main.js Requested by Host: app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `cb1b7d8d4cb4f503be126aaab18302b91acebb80d5f49b476c834c10fb9d76d3` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:12 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "08090eecdfdd81:0" Content-Length 7032 Content-Type application/javascript
GET H/1.1	200 OK	img1.jpg app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/img/	1 MB 1 MB	32ms 31ms	Image image/jpeg	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/img/img1.jpg Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `08e44df79f033daeb0375efd0c62ec5e3b13467388ed36815062f89ab2662940` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:18 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "0724f2cdfdd81:0" Content-Length 1181415 Content-Type image/jpeg
GET H/1.1	200 OK	img2.jpg app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/img/	15 KB 16 KB	31ms 30ms	Image image/jpeg	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/img/img2.jpg Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `550778f7050b2f39fc38c8e326c78e0a53921774f9f39dd3685f1c73efee2613` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:16 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "0daf2f0cdfdd81:0" Content-Length 15808 Content-Type image/jpeg
GET H/1.1	200 OK	img3.jpg app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/img/	274 KB 274 KB	29ms 29ms	Image image/jpeg	51.103.212.1 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/img/img3.jpg Protocol HTTP/1.1 Server 51.103.212.1 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.0 / Resource Hash `0caf058c53fc03f37915f7f4738582b863b20f34bf1bc53c890436bdf465dae0` Request headers accept-language de-DE,de;q=0.9 Referer http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/clients/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers Date Tue, 07 Mar 2023 09:46:06 GMT Last-Modified Mon, 21 Nov 2022 17:23:18 GMT Server Microsoft-IIS/8.0 Accept-Ranges bytes ETag "0724f2cdfdd81:0" Content-Length 280533 Content-Type image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: j84jsjvvi53d4stek14ersef57

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com/postde/pst/zd/templates/js/popper.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com
redigermanylagouyeouter.blob.core.windows.net
www.securewineshop.com
172.98.64.231
51.103.212.1
52.239.170.68
08e44df79f033daeb0375efd0c62ec5e3b13467388ed36815062f89ab2662940
0caf058c53fc03f37915f7f4738582b863b20f34bf1bc53c890436bdf465dae0
17e3aef8ea7ce8da06a44d59724748c6b9e389942a0c581bd82a45dad7f0f41e
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
550778f7050b2f39fc38c8e326c78e0a53921774f9f39dd3685f1c73efee2613
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
98f8b4b01ebae4460dd4c9b90a9c3a623f5263bfc51bcc3c8926ca3d4b8e9bdc
cb1b7d8d4cb4f503be126aaab18302b91acebb80d5f49b476c834c10fb9d76d3
ed32594ab88d0b8594b1978ff2cb2489ae234186e9e3d6c404731aa04fe20abd
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com Open in urlscan Pro 51.103.212.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

14 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

1885 kBTransfer

1882 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

app-id-bestsign-apc.switzerlandnorth.cloudapp.azure.com Open in urlscan Pro
51.103.212.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

14 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1885 kB
Transfer

1882 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!