emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz
Open in
urlscan Pro
128.14.223.70
Malicious Activity!
Public Scan
Effective URL: http://emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz/aW5NUnJ1Y2hyTWZ1cWFoREVlbUw1VExwWEFlRlRSbnV2UDNCK2x6L1JJVT0=/?AUTH_TOKEN=93d863039b059fc8f07e191...
Submission: On April 12 via manual from GB
Summary
This is the only time emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DKB (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 5 | 128.14.223.70 128.14.223.70 | 21859 (ZNET) (ZNET) | |
2 | 3 |
ASN21859 (ZNET, US)
c53357b7.sardiniacasa.biz | |
emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz | |
loa.gvswindowsistems.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
sardiniacasa.biz
2 redirects
c53357b7.sardiniacasa.biz emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz |
3 KB |
2 |
gvswindowsistems.com
1 redirects
loa.gvswindowsistems.com |
446 KB |
2 | 2 |
Domain | Requested by | |
---|---|---|
2 | loa.gvswindowsistems.com |
1 redirects
text
|
2 | c53357b7.sardiniacasa.biz | 2 redirects |
1 | emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz | |
2 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 3 frames:
Primary Page:
http://emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz/aW5NUnJ1Y2hyTWZ1cWFoREVlbUw1VExwWEFlRlRSbnV2UDNCK2x6L1JJVT0=/?AUTH_TOKEN=93d863039b059fc8f07e1911ee9489e58bac3fb4df77526317181977fda4f22c&cur=home&page=8f9ee6e1da961dffbe3688047b388c5425f942893f1bc92619839f700470780ce1b71eb32b75f3df067b5230a3233dee320e343507b3e760d27ac062755f5e8d.
Frame ID: 4782249EEE7415386C21CF27E04453B5
Requests: 1 HTTP requests in this frame
Frame:
data://truncated
Frame ID: F842961BC9ED41B784D04F9D4CDEAE2E
Requests: 1 HTTP requests in this frame
Frame:
http://loa.gvswindowsistems.com/dkb/
Frame ID: F6C91640F312A2F8221AEED6622FE7C7
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://c53357b7.sardiniacasa.biz/fr
HTTP 301
http://c53357b7.sardiniacasa.biz/fr/ HTTP 302
http://emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz/aW5NUnJ1Y2hyTWZ1cWFoREVlbUw1VExwWEFlRlRSbnV2UDNCK2x6L1JJVT0=/?AUTH_TOKEN=93d... Page URL
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://c53357b7.sardiniacasa.biz/fr
HTTP 301
http://c53357b7.sardiniacasa.biz/fr/ HTTP 302
http://emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz/aW5NUnJ1Y2hyTWZ1cWFoREVlbUw1VExwWEFlRlRSbnV2UDNCK2x6L1JJVT0=/?AUTH_TOKEN=93d863039b059fc8f07e1911ee9489e58bac3fb4df77526317181977fda4f22c&cur=home&page=8f9ee6e1da961dffbe3688047b388c5425f942893f1bc92619839f700470780ce1b71eb32b75f3df067b5230a3233dee320e343507b3e760d27ac062755f5e8d. Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://loa.gvswindowsistems.com/dkb HTTP 301
- http://loa.gvswindowsistems.com/dkb/
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz/aW5NUnJ1Y2hyTWZ1cWFoREVlbUw1VExwWEFlRlRSbnV2UDNCK2x6L1JJVT0=/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F842 |
833 B 833 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
loa.gvswindowsistems.com/dkb/ Frame F6C9 Redirect Chain
|
446 KB 446 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
8 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
208 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
686 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
944 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
669 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
864 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
871 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F6C9 |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DKB (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated string| write_iframe0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c53357b7.sardiniacasa.biz
emiratespost.ae-portal-homelocaleen-b075f9da.sardiniacasa.biz
loa.gvswindowsistems.com
128.14.223.70
0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9
0dc8ef04bdfa4bdcc7e3ee763b344fb6b07fcf9e357dfd312fa1db91ab936c50
1c9524bad0ee009f3f9e6af79cf3363acbcd6a4f03eec2ca8c16ff794358d81d
44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af
54d31025c9536bf38b4f89d7fdc5261bb87dfe924d7445a7d56b43533c86e8cb
56ece0b6031051ff29a3d3d4150209d73d3c2826939dce4a779701d771b1f7dc
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb
e192ef893ace807106a92c606f1e4c383a6fe0c6f3274b3c580b05ac8cdccfa3
f322ce3ae49398196ed558d8c87124761aea08587439d70c4764b89371958b22
fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd