postfinancemeineswitzerland.000webhostapp.com
Open in
urlscan Pro
2a02:4780:dead:8a50::1
Malicious Activity!
Public Scan
Effective URL: https://postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/index.html
Submission: On October 13 via automatic, source phishtank
Summary
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.
This is the only time postfinancemeineswitzerland.000webhostapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostFinance (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a02:2350:5:1... 2a02:2350:5:106:6540:0:7d96:787a | 51468 (ONECOM) (ONECOM) | |
1 11 | 2a02:4780:dea... 2a02:4780:dead:8a50::1 | 204915 (AWEX) (AWEX) | |
1 | 2606:4700:10:... 2606:4700:10::6814:442e | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
11 | 2 |
ASN204915 (AWEX, US)
postfinancemeineswitzerland.000webhostapp.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.000webhost.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
000webhostapp.com
1 redirects
postfinancemeineswitzerland.000webhostapp.com |
583 KB |
1 |
000webhost.com
cdn.000webhost.com |
2 KB |
1 |
ccdenmark.dk
1 redirects
ccdenmark.dk |
354 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
11 | postfinancemeineswitzerland.000webhostapp.com |
1 redirects
postfinancemeineswitzerland.000webhostapp.com
|
1 | cdn.000webhost.com |
postfinancemeineswitzerland.000webhostapp.com
|
1 | ccdenmark.dk | 1 redirects |
11 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.000webhost.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.000webhostapp.com RapidSSL RSA CA 2018 |
2019-06-11 - 2021-07-10 |
2 years | crt.sh |
*.000webhost.com COMODO RSA Domain Validation Secure Server CA |
2018-10-19 - 2020-12-17 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/index.html
Frame ID: 40BE0CB7C8EFD3D0BB94191F3A33E077
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://ccdenmark.dk/onewebstatic/
HTTP 302
https://postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/index.php HTTP 302
https://postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/index.html Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ccdenmark.dk/onewebstatic/
HTTP 302
https://postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/index.php HTTP 302
https://postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ Redirect Chain
|
280 KB 202 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.hv.min.css
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
609 KB 87 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NinaLoader.css
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
2 KB 977 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e4458ea117887aa57d951a50bc4ee98ac49802d0
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
53 KB 53 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons--sprite.png
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
74 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
input-border-left.png
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
942 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a06e7cd24d9530dfc14f3a3662b99d9a949cdd70
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
38 KB 38 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frutiger-bold.woff
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
50 KB 51 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frutiger-light.woff
postfinancemeineswitzerland.000webhostapp.com/postfinance/postfinance/loginpostfinance/ |
70 KB 70 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostFinance (Banking)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| getCookie object| notification object| hostingerLogo undefined| mainContent object| newList undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| h1Tag undefined| paragraph undefined| list undefined| listElements undefined| org_html undefined| new_html undefined| saleImage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ccdenmark.dk
cdn.000webhost.com
postfinancemeineswitzerland.000webhostapp.com
2606:4700:10::6814:442e
2a02:2350:5:106:6540:0:7d96:787a
2a02:4780:dead:8a50::1
01624305dc5783545976f848fdc075223ae88a8170d1e261aea9474bd28e9e25
02eb02cdb556defb1b4e160fff6868045f5d2f83fb7da6f8bb6b9b8dda23bb58
10709bfa3f00c47458c2a4f17141a70c7d0da0c0336f1837951f9f1f3aebb9c8
1bb9538ac316b009ab5bea8f4ae7c6c799c385fdc751ddeab89e46e41777bb9c
27043bf4dce28d804d8d9792efdd4f945ae7a4c4020c564a4c167c571b162cbd
366e65bfded030e86bd091910d44ffaa84baab32fc04613ee1385fb3b43257b6
48b7ef909dfdf7f2a60b40fb8f008f099e31961a8b73193ce007432d1c0f1ce9
4a6189a502082dd06025769c699554ddb4c277b74bcbd2bb1fa99976ba876176
6e2341a524af81d8b9362e829287bede024d49eb00f2983f39ef3e8675614ac6
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
dae956e2ff95d5c30fdcaad156e8179bd5c411e1c59bc254d7b16cab7f1724d9