![](/screenshots/e5dbd240-bd4e-4ad4-a41f-869f667d178d.png)
fotocuadros.com
Open in
urlscan Pro
185.177.153.207
Malicious Activity!
Public Scan
Effective URL: https://fotocuadros.com/MY/MYBNQ/home/pstB-id.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVX...
Submission: On January 12 via manual from DE — Scanned from NL
Summary
TLS certificate: Issued by R3 on December 13th 2022. Valid for: 3 months.
This is the only time fotocuadros.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 185.213.172.179 185.213.172.179 | 41608 (NEXTGENWE...) (NEXTGENWEBS-NL) | |
2 5 | 185.177.153.207 185.177.153.207 | 201446 (PROFESION...) (PROFESIONALHOSTING) | |
4 | 3 |
ASN201446 (PROFESIONALHOSTING, ES)
PTR: dns153207.phdns14.es
fotocuadros.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
fotocuadros.com
2 redirects
fotocuadros.com |
893 KB |
1 |
estilmenut.com
estilmenut.com |
384 B |
4 | 2 |
Domain | Requested by | |
---|---|---|
5 | fotocuadros.com |
2 redirects
fotocuadros.com
|
1 | estilmenut.com | |
4 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
estilmenut.com R3 |
2022-11-24 - 2023-02-22 |
3 months | crt.sh |
fotocuadros.com R3 |
2022-12-13 - 2023-03-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fotocuadros.com/MY/MYBNQ/home/pstB-id.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwOC4wLjUzNTkuMTI0IFNhZmFyaS81MzcuMzYzMS4yMDQuMTUwLjEwODIwMjM6SmFuOlRodQ==
Frame ID: E6C561CBB077C864F1C20C280E7A8C0E
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/e5dbd240-bd4e-4ad4-a41f-869f667d178d.png)
Page Title
LoginPage URL History Show full URLs
- https://estilmenut.com/MY/MYBNQ/ Page URL
-
https://fotocuadros.com/MY/MYBNQ
HTTP 301
https://fotocuadros.com/MY/MYBNQ/ Page URL
-
https://fotocuadros.com/MY/MYBNQ/home/
HTTP 302
https://fotocuadros.com/MY/MYBNQ/home/pstB-id.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2lu... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://estilmenut.com/MY/MYBNQ/ Page URL
-
https://fotocuadros.com/MY/MYBNQ
HTTP 301
https://fotocuadros.com/MY/MYBNQ/ Page URL
-
https://fotocuadros.com/MY/MYBNQ/home/
HTTP 302
https://fotocuadros.com/MY/MYBNQ/home/pstB-id.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwOC4wLjUzNTkuMTI0IFNhZmFyaS81MzcuMzYzMS4yMDQuMTUwLjEwODIwMjM6SmFuOlRodQ== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://fotocuadros.com/MY/MYBNQ HTTP 301
- https://fotocuadros.com/MY/MYBNQ/
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
estilmenut.com/MY/MYBNQ/ |
134 B 384 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
fotocuadros.com/MY/MYBNQ/ Redirect Chain
|
104 B 360 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
pstB-id.php
fotocuadros.com/MY/MYBNQ/home/ Redirect Chain
|
804 KB 805 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
370 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
186 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
fotocuadros.com/MY/MYBNQ/home/pstB_files/ |
86 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
estilmenut.com
fotocuadros.com
185.177.153.207
185.213.172.179
019f16fa726362bad3b1f8e48d047afd3bfbeeb4fa048a95d5eea6c40a928418
0efae8927c3a86e353d09d08ec7f30d5e18260295b589d68c66a24dff5ba944a
130d73c4eb6e09d7372576762b61bdc69ccc112befefde6c40220278baf30686
1ad849d8a916dcde00adb1ee3d0f21c7f636a98b7b2c49f57194f245d37b2e91
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
550778f7050b2f39fc38c8e326c78e0a53921774f9f39dd3685f1c73efee2613
946660bb68994bd9480fd5822b55ebd2907bcf76927305e84f47c20431568789