secure350.servconfig.com
Open in
urlscan Pro
213.165.242.55
Malicious Activity!
Public Scan
Submission: On May 30 via api from BG — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 16th 2024. Valid for: a year.
This is the only time secure350.servconfig.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 213.165.242.55 213.165.242.55 | 22611 (INMOTION) (INMOTION) | |
| 2 | 2 |
ASN22611 (INMOTION, US)
PTR: amsres350.servconfig.com
| secure350.servconfig.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
servconfig.com
secure350.servconfig.com |
2 MB |
| 2 | 1 |
| Domain | Requested by | |
|---|---|---|
| 2 | secure350.servconfig.com |
secure350.servconfig.com
|
| 2 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| banking.postbank.de |
| www.postbank.de |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.servconfig.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-16 - 2025-03-11 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://secure350.servconfig.com/~a373525/box/
Frame ID: 8FF2FCC717AD196E520B4CF70C2FDFD3
Requests: 7 HTTP requests in this frame
Frame:
https://secure350.servconfig.com/~a373525/box/Postbank%20Banking%20&%20Brokerage.._files/saved_resource.html
Frame ID: 54F4D0AA16BCF07D5C5851724AAB45E2
Requests: 1 HTTP requests in this frame
13 Outgoing links
These are links going to different origins than the main page.
Title: Zugangsdaten vergessen?
Search URL Search Domain Scan URL
Title: Zum Postbank Zinssparen
Search URL Search Domain Scan URL
Title: Alles Wichtige zum Online-Banking
Search URL Search Domain Scan URL
Title: Informationen für Privatkunden
Search URL Search Domain Scan URL
Title: Informationen für Geschäftskunden
Search URL Search Domain Scan URL
Title: Postbank ID einrichten
Search URL Search Domain Scan URL
Title: Zu den aktuellen Sicherheitshinweisen
Search URL Search Domain Scan URL
Title: Erste Schritte
Search URL Search Domain Scan URL
Title: Terminvereinbarung
Search URL Search Domain Scan URL
Title: Kontakt
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: Rechtshinweise
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
secure350.servconfig.com/~a373525/box/ |
2 MB 2 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
243 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
247 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
saved_resource.html
secure350.servconfig.com/~a373525/box/Postbank%20Banking%20&%20Brokerage.._files/ Frame 54F4 |
483 B 537 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure350.servconfig.com
213.165.242.55
02e6dbdfca6b937ecdfc58243416e028997733e6df871ce833fee5c10c96657b
07d6126a6cf6fd69aa3604dab020b277f4f1d470007865bf8d2dbfcae2f8711e
12164efcaf829ad24ff7a8367cdcd40dde1d4c23d437d28d791617a8827d7115
3ab65524380fa9267bbcf2d4df64def918baeeaf4df69a2d58026d2149b68d96
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
817881650ee0edc8d2f2de7be553daf45fd424c92b580da50bafe12dab611866
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de