postbank-aktualiserung.com Open in urlscan Pro
47.251.36.235  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://thf.com.my/maine-housing-tcgrp/layout_up.php?r=bD1odHRwczovL3Bvc3RiYW5rLWFrdHVhbGlzZXJ1bmcuY29tL1JBRzc0RExSRzM%3D Page URL
2. https://postbank-aktualiserung.com/RAG74DLRG3 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	layout_up.php Show response thf.com.my/maine-housing-tcgrp/	90 B 323 B	1021ms 440ms	Document text/html	110.4.45.205 EXABYTES-AS-AP Ex...
General Check archive.org Show headers Download Go to Full URL http://thf.com.my/maine-housing-tcgrp/layout_up.php?r=bD1odHRwczovL3Bvc3RiYW5rLWFrdHVhbGlzZXJ1bmcuY29tL1JBRzc0RExSRzM%3D Protocol HTTP/1.1 Server 110.4.45.205 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY), Reverse DNS zygentoma.mschosting.com Software Apache / Resource Hash c37a2517e55ab3a1b2f014c6a439cf90b73523abfc75554b0168c6cc2b1aad25 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Wed, 15 Dec 2021 06:28:55 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request RAG74DLRG3 Show response postbank-aktualiserung.com/	694 KB 285 KB	1453ms 562ms	Document text/html	47.251.36.235 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://postbank-aktualiserung.com/RAG74DLRG3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.251.36.235 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash f7623e438cb78b9a75aa5027148609d4fc3788a4d999dbf6df004a1a063c9b02 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://thf.com.my/ Response headers Server nginx Date Wed, 15 Dec 2021 06:28:56 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Content-Encoding gzip
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/	156 KB 25 KB	35ms 18ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://postbank-aktualiserung.com/ Origin https://postbank-aktualiserung.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 06:28:56 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601 age 54024 cdn-cachedat 08/03/2021 15:16:56 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 cdn-proxyver 1.0 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:09 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid bd95d1677fc3edd51119610ac59c9ef8 cf-ray 6bdd9d5d9e004e2c-FRA cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET DATA	200 OK	truncated /	1016 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	postbank-bestsign-app-geraet-siegel.png postbank-aktualiserung.com/	73 KB 74 KB	331ms 331ms	Image image/png	47.251.36.235 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://postbank-aktualiserung.com/postbank-bestsign-app-geraet-siegel.png Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.251.36.235 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash 54070932407a2fc13db563a3f20483f13eda409ff59eb430a7a2f335eb6decd9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://postbank-aktualiserung.com/RAG74DLRG3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 06:28:57 GMT Last-Modified Thu, 09 Dec 2021 15:41:30 GMT Server nginx ETag "61b223aa-12593" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 75155
GET H/1.1	200 OK	privatkredit-weihnachtsmotiv-login.jpg postbank-aktualiserung.com/	69 KB 70 KB	501ms 501ms	Image image/jpeg	47.251.36.235 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://postbank-aktualiserung.com/privatkredit-weihnachtsmotiv-login.jpg Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.251.36.235 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash d7fc0f46ae21ad67622ec09ec5f0fecf73632fa0169b6ec2baf04c5b5681f742 Request headers Accept-Language de-DE,de;q=0.9 Referer https://postbank-aktualiserung.com/RAG74DLRG3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 06:28:57 GMT Last-Modified Thu, 09 Dec 2021 15:41:31 GMT Server nginx ETag "61b223ab-1153b" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 70971
GET H/1.1	200 OK	login-alte-anmeldung.jpg postbank-aktualiserung.com/	15 KB 15 KB	665ms 330ms	Image image/jpeg	47.251.36.235 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://postbank-aktualiserung.com/login-alte-anmeldung.jpg Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.251.36.235 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash 2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14 Request headers Accept-Language de-DE,de;q=0.9 Referer https://postbank-aktualiserung.com/RAG74DLRG3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 06:28:57 GMT Last-Modified Thu, 09 Dec 2021 15:41:30 GMT Server nginx ETag "61b223aa-3c6f" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 15471
GET H/1.1	404 Not Found	bestsign.svg postbank-aktualiserung.com/bundles/@pbs/legitimation-bestsign/lib/runtime/assets/legitimation/images/	16 B 16 B	996ms 330ms	Image text/html	47.251.36.235 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://postbank-aktualiserung.com/bundles/@pbs/legitimation-bestsign/lib/runtime/assets/legitimation/images/bestsign.svg Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.251.36.235 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 Request headers Accept-Language de-DE,de;q=0.9 Referer https://postbank-aktualiserung.com/RAG74DLRG3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 06:28:57 GMT Content-Encoding gzip Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	29ms 12ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer Origin https://postbank-aktualiserung.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 06:28:57 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1071675 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27938 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FBvQXjh4d8O1bcOzoQ3U1nMj0HmhhjTjtOO7%2FRg%2Fb5rk7AkaC2J8VCh88YK6ehU8Qz44gkbNNajE0CF4f6m0uYlPcRUjfSTO6GhSYVH3dpTPMqEEZXShSPWbXyRhvR27Qou5IMvLmln%2BDb998%2FhwRDim"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6bdd9d60d8014357-FRA expires Mon, 05 Dec 2022 06:28:57 GMT
GET H/1.1	404 Not Found	svg-icon-sprite.svg postbank-aktualiserung.com/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/	0 0	1012ms 339ms	Other text/html	47.251.36.235 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://postbank-aktualiserung.com/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg Requested by Host: postbank-aktualiserung.com URL: https://postbank-aktualiserung.com/RAG74DLRG3 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 47.251.36.235 Santa Clara, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://postbank-aktualiserung.com/RAG74DLRG3 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 06:28:57 GMT Content-Encoding gzip Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	48 KB 48 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c Request headers Referer Origin https://postbank-aktualiserung.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	41 KB 41 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d Request headers Referer Origin https://postbank-aktualiserung.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type font/woff2

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| isCharacterALetter function| ueberlastet function| hide_pass_div function| hide_pass_div_chip function| hide_chiptandiv function| check_valid function| check_logged_in function| check_chiptan function| hide_logged_in_div

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			postbank-aktualiserung.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ogku7hm09b0dlbsfv0mv1fpbpn

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://postbank-aktualiserung.com/bundles/@pbs/legitimation-bestsign/lib/runtime/assets/legitimation/images/bestsign.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://postbank-aktualiserung.com/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg#icon-info Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
postbank-aktualiserung.com
stackpath.bootstrapcdn.com
thf.com.my
110.4.45.205
2606:4700::6810:125e
2606:4700::6812:acf
47.251.36.235
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c
2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20
54070932407a2fc13db563a3f20483f13eda409ff59eb430a7a2f335eb6decd9
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
c37a2517e55ab3a1b2f014c6a439cf90b73523abfc75554b0168c6cc2b1aad25
d7fc0f46ae21ad67622ec09ec5f0fecf73632fa0169b6ec2baf04c5b5681f742
f7623e438cb78b9a75aa5027148609d4fc3788a4d999dbf6df004a1a063c9b02
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e