![](/screenshots/c795bdbd-084a-4c63-9f79-9adb7e9e10a2.png)
0ed56e7.wcomhost.com
Open in
urlscan Pro
206.188.192.7
Malicious Activity!
Public Scan
Effective URL: https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/
Submission: On April 12 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 19th 2022. Valid for: a year.
This is the only time 0ed56e7.wcomhost.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID) | |
3 3 | 206.188.193.252 206.188.193.252 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
3 5 | 206.188.192.7 206.188.192.7 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
2 | 2 |
ASN11377 (SENDGRID, US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u14178730.ct.sendgrid.net |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: vux.netsolhost.com
0ed56dd.wcomhost.com |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: vux.netsolhost.com
0ed56e7.wcomhost.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
wcomhost.com
6 redirects
0ed56dd.wcomhost.com 0ed56e7.wcomhost.com |
610 KB |
1 |
sendgrid.net
1 redirects
u14178730.ct.sendgrid.net |
238 B |
2 | 2 |
Domain | Requested by | |
---|---|---|
5 | 0ed56e7.wcomhost.com |
3 redirects
0ed56e7.wcomhost.com
|
3 | 0ed56dd.wcomhost.com | 3 redirects |
1 | u14178730.ct.sendgrid.net | 1 redirects |
2 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.postbank.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wcomhost.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-19 - 2023-09-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/
Frame ID: 95FDB0137C968CBEE54C31DE41703270
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/c795bdbd-084a-4c63-9f79-9adb7e9e10a2.png)
Page Title
Postbank Banking & BrokeragePage URL History Show full URLs
-
https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcof8PZ8pxAP1ROah5YZ65WXeOllJEJgZK7ami0ktX...
HTTP 302
https://0ed56dd.wcomhost.com/de-de/ HTTP 302
https://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908 HTTP 301
http://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908/ HTTP 307
https://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908/ HTTP 302
https://0ed56e7.wcomhost.com/postde/pst/ HTTP 302
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463 HTTP 301
http://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/ HTTP 307
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/ Page URL
-
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients
HTTP 301
http://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/ HTTP 307
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/ Page URL
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: Informationen für Privatkunden
Search URL Search Domain Scan URL
Title: Informationen für Geschäftskunden
Search URL Search Domain Scan URL
Title: Postbank ID einrichten
Search URL Search Domain Scan URL
Title: Zu den Sicherheitshinweisen
Search URL Search Domain Scan URL
Title: Erste Schritte
Search URL Search Domain Scan URL
Title: Terminvereinbarung
Search URL Search Domain Scan URL
Title: Kontakt
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: Rechtshinweise
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcof8PZ8pxAP1ROah5YZ65WXeOllJEJgZK7ami0ktXoVwXI0V_JKgzMr9Bk-2B9QH4TsrY4Z6Wwy7Aa3jGaNqvsOmu-2F88TCmKuTVlhZoD8j3zhcTS8EYbutoLU8B-2Fds5EogzvNs0IAABc0oCY5VrY7-2FQwtsF6xGL5a4JKOm72ZY-2FfY8NuBjZK4jL-2FbBpYz6p5Z5R0POlvozhv55mmzyN2hAajQ0Gn7BHgKDCQz3te5MBkPN-2B96sC0cmGAA7mM2gnGSTxJA1GmRc-2F5CgyqeyWJ4NU6jyzD3SaUseFFrIRJD3S-2FCz90JFJcVbtuF25GNlF6y64i9FvCeQTWieU9dH8zs-2FLyxoQ3lhN40uZiac7pJd1-2B0-2FHzxyfMCAd2YWt0lTetkr8RQwSZQ-3D-3D
HTTP 302
https://0ed56dd.wcomhost.com/de-de/ HTTP 302
https://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908 HTTP 301
http://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908/ HTTP 307
https://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908/ HTTP 302
https://0ed56e7.wcomhost.com/postde/pst/ HTTP 302
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463 HTTP 301
http://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/ HTTP 307
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/ Page URL
-
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients
HTTP 301
http://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/ HTTP 307
https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u14178730.ct.sendgrid.net/ls/click?upn=5wGz-2FkRhFmpOV3S6FLMxcof8PZ8pxAP1ROah5YZ65WXeOllJEJgZK7ami0ktXoVwXI0V_JKgzMr9Bk-2B9QH4TsrY4Z6Wwy7Aa3jGaNqvsOmu-2F88TCmKuTVlhZoD8j3zhcTS8EYbutoLU8B-2Fds5EogzvNs0IAABc0oCY5VrY7-2FQwtsF6xGL5a4JKOm72ZY-2FfY8NuBjZK4jL-2FbBpYz6p5Z5R0POlvozhv55mmzyN2hAajQ0Gn7BHgKDCQz3te5MBkPN-2B96sC0cmGAA7mM2gnGSTxJA1GmRc-2F5CgyqeyWJ4NU6jyzD3SaUseFFrIRJD3S-2FCz90JFJcVbtuF25GNlF6y64i9FvCeQTWieU9dH8zs-2FLyxoQ3lhN40uZiac7pJd1-2B0-2FHzxyfMCAd2YWt0lTetkr8RQwSZQ-3D-3D HTTP 302
- https://0ed56dd.wcomhost.com/de-de/ HTTP 302
- https://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908 HTTP 301
- http://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908/ HTTP 307
- https://0ed56dd.wcomhost.com/de-de/e9b2c5bfc45268b7782bb8fdb4435908/ HTTP 302
- https://0ed56e7.wcomhost.com/postde/pst/ HTTP 302
- https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463 HTTP 301
- http://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/ HTTP 307
- https://0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/ Redirect Chain
|
151 B 430 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
0ed56e7.wcomhost.com/postde/pst/9fbe446fa58e8626a463/clients/ Redirect Chain
|
1 MB 608 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
243 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
44 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
0ed56e7.wcomhost.com/ | Name: PHPSESSID Value: 39e90f358d641b1b234bf9071f25630e |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | "1; mode=block" |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0ed56dd.wcomhost.com
0ed56e7.wcomhost.com
u14178730.ct.sendgrid.net
167.89.123.16
206.188.192.7
206.188.193.252
039d3f592f13a313b222347d081def6d3e91dc571f445c5a557bf6bc617d9148
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
d4664dd3d67bd3bbe6653fe5273756db06a66ed9f6b2e3d317a28c5bd04ecb90
fdff80a70c9c788e4c93d02eff684aa381d0f26bf9565edfd1bfdb15c602b4e4