home-login-postfinance.on.drv.tw
Open in
urlscan Pro
47.251.10.111
Malicious Activity!
Public Scan
Effective URL: https://home-login-postfinance.on.drv.tw/mein/home.html
Submission: On December 17 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on October 30th 2023. Valid for: 3 months.
This is the only time home-login-postfinance.on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostFinance (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 147.50.231.65 147.50.231.65 | 9891 (CSLOX-IDC...) (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.) | |
2 7 | 47.251.10.111 47.251.10.111 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 20.75.109.112 20.75.109.112 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
4 | 2607:f8b0:400... 2607:f8b0:4004:c08::61 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2600:9000:20e... 2600:9000:20e2:8400:5:6c74:c540:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2607:f8b0:400... 2607:f8b0:4004:c08::8a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4860:480... 2001:4860:4802:38::181 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2607:f8b0:400... 2607:f8b0:4004:c08::9a | 15169 (GOOGLE) (GOOGLE) | |
22 | 10 |
ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: killadds.co.uk
poasloumandosvaskil.com | |
farmchokchai.com |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
home-login-postfinance.on.drv.tw |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
drv.tw
2 redirects
home-login-postfinance.on.drv.tw www.drv.tw — Cisco Umbrella Rank: 951051 cdn-of.drv.tw |
447 KB |
4 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 36 |
226 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27 |
21 KB |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 75 |
414 B |
2 |
google.com
analytics.google.com — Cisco Umbrella Rank: 152 |
320 B |
2 |
poasloumandosvaskil.com
2 redirects
poasloumandosvaskil.com |
354 B |
1 |
farmchokchai.com
farmchokchai.com |
3 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 735 |
30 KB |
0 |
jkdluxlimo.com
Failed
jkdluxlimo.com Failed |
|
22 | 9 |
Domain | Requested by | |
---|---|---|
7 | home-login-postfinance.on.drv.tw |
2 redirects
home-login-postfinance.on.drv.tw
|
4 | www.googletagmanager.com |
www.drv.tw
www.googletagmanager.com |
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | analytics.google.com |
www.googletagmanager.com
|
2 | cdn-of.drv.tw |
home-login-postfinance.on.drv.tw
|
2 | poasloumandosvaskil.com | 2 redirects |
1 | www.drv.tw |
home-login-postfinance.on.drv.tw
|
1 | farmchokchai.com |
home-login-postfinance.on.drv.tw
|
1 | code.jquery.com |
home-login-postfinance.on.drv.tw
|
0 | jkdluxlimo.com Failed |
code.jquery.com
|
22 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drv.tw R3 |
2023-10-30 - 2024-01-28 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
farmchokchai.com R3 |
2023-11-23 - 2024-02-21 |
3 months | crt.sh |
www.drv.tw GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2023-07-31 - 2024-01-31 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://home-login-postfinance.on.drv.tw/mein/home.html
Frame ID: 13B17DEB8C635581660FA315188EB55B
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
PostFinance - E-FinancePage URL History Show full URLs
-
http://poasloumandosvaskil.com/
HTTP 301
https://poasloumandosvaskil.com/ HTTP 302
https://home-login-postfinance.on.drv.tw/mein/home.html Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://poasloumandosvaskil.com/
HTTP 301
https://poasloumandosvaskil.com/ HTTP 302
https://home-login-postfinance.on.drv.tw/mein/home.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW06-Light.23770ae90a0ac3d5.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b?ra=4710g5kXVh4nMPJbrNKJ-wsPopiM2XGHQFSARAS8XAKYgCa41sS3uXDg1jWCWDB_k35EvCyutXI7q8xwo7rb0dHGym7TEIF0EDQK3mxK1zZJrD15TfhzZz9Cp-e2M9OYkiYHK9MIsQUulbjwkctcr8TocQKwC9jtB83FoFVTl12M88kwt0fUZRiaaKcfe5Zg36QZquKBB-VH2M9Ayb_BfA0a.92ay
- https://home-login-postfinance.on.drv.tw/mein/log_files/FrutigerNeueLTW05-Medium.58a0ff866e7c76b1.woff2 HTTP 302
- https://cdn-of.drv.tw/_guf/home-login-postfinance/1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH?ra=4710g5kXVh4nMPJbrNKJ-wsPopiM2XGHQFSARAS8XAKYgCa41sS3uXDg1jWCWDB_k35EvCyutXI7q8xwo7rb0dHGym7TEIF0EDQK3mxK1zZJrD15TfhzZz9Cp-e2M9OYkiYHK9MIsQUulbjwkctcr8TocQKwC9jtB83FoFVTl12M88kwt0fUZRiaaKcfe5Zg36QZquKBB-VH2M9Ayb_BfA0a.92ay
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.html
home-login-postfinance.on.drv.tw/mein/ Redirect Chain
|
143 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.f88b886e8d70eb8b.css
home-login-postfinance.on.drv.tw/mein/log_files/ |
202 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.ccs.js
farmchokchai.com/home/mein/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
www.drv.tw/inc/ |
690 B 841 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.9e673858d384d2a88ba2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
61 KB 14 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other.baa9f8e29ae4e29778d2.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
13 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.ce995d22237219656e3a.svg
home-login-postfinance.on.drv.tw/mein/log_files/ |
1 MB 281 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
132 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1vDsP_Nam5A7rQaaPTbk_PXXvR4W7QE4b
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
42 KB 43 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1u5B3xQ0jDBBeYTJjcQOPUBcTG2_992YH
cdn-of.drv.tw/_guf/home-login-postfinance/ Redirect Chain
|
41 KB 42 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
file.php
jkdluxlimo.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
224 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
285 KB 93 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 266 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 266 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 174 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 92 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 148 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
a
www.googletagmanager.com/ |
0 11 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jkdluxlimo.com
- URL
- https://jkdluxlimo.com/file.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostFinance (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery string| base_url string| chat_id function| checkStatus function| cleanUp function| validate function| formatString function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
home-login-postfinance.on.drv.tw/ | Name: uid Value: rBI/+mV+80gAwGtWVLdaAg== |
|
.drv.tw/ | Name: _ga_LHL0SH0Z7S Value: GS1.1.1702818635.1.0.1702818635.60.0.0 |
|
.drv.tw/ | Name: _ga Value: GA1.2.2064047139.1702818635 |
|
.drv.tw/ | Name: _gid Value: GA1.2.1642356650.1702818635 |
|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga_NBGQJBJMEG Value: GS1.1.1702818635.1.0.1702818637.0.0.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.google.com
cdn-of.drv.tw
code.jquery.com
farmchokchai.com
home-login-postfinance.on.drv.tw
jkdluxlimo.com
poasloumandosvaskil.com
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.googletagmanager.com
jkdluxlimo.com
147.50.231.65
20.75.109.112
2001:4860:4802:38::181
2600:9000:20e2:8400:5:6c74:c540:93a1
2607:f8b0:4004:c08::61
2607:f8b0:4004:c08::8a
2607:f8b0:4004:c08::9a
2a04:4e42::649
47.251.10.111
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
115394c0d6feaa2e24d99ef71e6fafcc2f9dfbcb2887eb1ddea7b96a0ea83ba1
1f36ed77df4925dfdd69129329b51cb52991fb97d9203faa34b60e76d76b8ab2
36468d7978ef11b2f74e03b789af70980e839aff47b9336f867aedeca554688c
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
505b008f3358325ec97ec9ecc265fcb0b28dbe1117498e20e5e72dc1f36a847b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cd0831888af056208066accccd9de5470925b62abd26b87dd672eeb72975f26
9e3c106724b88a584f5510a4ec193bfc8930a976236617f50c023e6a5ca7eb38
a2b3932ea638b1748460e11db294266a5923cd9aa4a2795d0e03cc2f59271502
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079
d57f0454f106eff11c18b45792a1be05ca0cd79ea653a201a37939e8235eff73
ddcf221f9ba32ec5d0bd05ad2207e370e7d399e7dd348ea1fee2c0e7c1135c0d
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea973ba7beb8f95ee114ab45a171b0e0ddc50ba57932183de17c4449809cb818