urlscan.io logo urlscan.io
SecurityTrails logo

www-logs-banking.canadacentral.cloudapp.azure.com Open in urlscan Pro
52.228.67.52  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ts.hust.edu.vn/vendor/mews/tks/bestsgnappse.html
Effective URL: http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/
Submission: On August 12 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 52.228.67.52, located in and belongs to . The main domain is www-logs-banking.canadacentral.cloudapp.azure.com.
This is the only time www-logs-banking.canadacentral.cloudapp.azure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 202.191.56.152 38727 (HUT-AS-VN...)
1 2 20.219.75.239 8075 (MICROSOFT...)
2 52.228.67.52 ()
4 4
Apex Domain
Subdomains		 Transfer
4 azure.com
redinationagermanp.southindia.cloudapp.azure.com
www-logs-banking.canadacentral.cloudapp.azure.com
796 B
1 hust.edu.vn
ts.hust.edu.vn — Cisco Umbrella Rank: 417249
640 B
4 2
Domain Requested by
2 www-logs-banking.canadacentral.cloudapp.azure.com redinationagermanp.southindia.cloudapp.azure.com
www-logs-banking.canadacentral.cloudapp.azure.com
2 redinationagermanp.southindia.cloudapp.azure.com 1 redirects
1 ts.hust.edu.vn
4 3

This site contains no links.

Subject Issuer Validity Valid
ts.hust.edu.vn
R3		 2022-07-15 -
2022-10-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/
Frame ID: E442DEC66E44B108606570AA933CA7C1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://ts.hust.edu.vn/vendor/mews/tks/bestsgnappse.html Page URL
  2. http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/index.php?id=885454 HTTP 302
    http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/index.php?43581e01da5074de0ede?portal43581e01da5074... Page URL
  3. http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/ Page URL

Page Statistics

4
Requests

25 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

2
Countries

90 kB
Transfer

1248 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ts.hust.edu.vn/vendor/mews/tks/bestsgnappse.html Page URL
  2. http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/index.php?id=885454 HTTP 302
    http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/index.php?43581e01da5074de0ede?portal43581e01da5074?ret43581e01 Page URL
  3. http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/index.php?id=885454 HTTP 302
  • http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/index.php?43581e01da5074de0ede?portal43581e01da5074?ret43581e01

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
bestsgnappse.html
ts.hust.edu.vn/vendor/mews/tks/ 		167 B
640 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ts.hust.edu.vn/vendor/mews/tks/bestsgnappse.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
202.191.56.152 , Viet Nam, ASN38727 (HUT-AS-VN Ha Noi University of Technology, VN),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
d17e6ad8bd573ff47eed2ee2f494e0612a1cddb46e06c7e52d1187d6f48bf141
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Length
167
Content-Type
text/html
Date
Fri, 12 Aug 2022 14:02:52 GMT
ETag
"62a9ccbf-a7"
Expires
Thu, 31 Dec 2037 23:55:55 GMT
Keep-Alive
timeout=60
Last-Modified
Wed, 15 Jun 2022 12:12:47 GMT
Server
nginx/1.16.1
Strict-Transport-Security
max-age=31536000
X-Cache
HIT from Backend
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
index.php
redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/
Redirect Chain
  • http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/index.php?id=885454
  • http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/index.php?43581e01da5074de0ede?portal43581e01da5074?ret43581e01
163 B
334 B 		Document
General
Check archive.org
Download Go to
Full URL
http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/index.php?43581e01da5074de0ede?portal43581e01da5074?ret43581e01
Protocol
HTTP/1.1
Server
20.219.75.239 Chennai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / PHP/5.6.31
Resource Hash

Request headers

Referer
https://ts.hust.edu.vn/vendor/mews/tks/bestsgnappse.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
163
Content-Type
text/html; charset=UTF-8
Date
Fri, 12 Aug 2022 14:02:12 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
PHP/5.6.31

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Fri, 12 Aug 2022 14:02:12 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
./meine/index.php?43581e01da5074de0ede?portal43581e01da5074?ret43581e01
Pragma
no-cache
Server
Microsoft-IIS/10.0
X-Powered-By
PHP/5.6.31
Primary Request /
www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/ 		1 MB
0 		Document
General
Check archive.org
Download Go to
Full URL
http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/
Requested by
Host: redinationagermanp.southindia.cloudapp.azure.com
URL: http://redinationagermanp.southindia.cloudapp.azure.com/TASERVCK2112API/61/meine/index.php?43581e01da5074de0ede?portal43581e01da5074?ret43581e01
Protocol
HTTP/1.1
Server
52.228.67.52 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/8.0 / PHP/5.6.31
Resource Hash

Request headers

Referer
http://redinationagermanp.southindia.cloudapp.azure.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
1618105
Content-Type
text/html; charset=UTF-8
Date
Fri, 12 Aug 2022 14:02:15 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
PHP/5.6.31
svg-icon-sprite.svg
www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg
Requested by
Host: www-logs-banking.canadacentral.cloudapp.azure.com
URL: http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/
Protocol
HTTP/1.1
Server
52.228.67.52 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/8.0 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date
Fri, 12 Aug 2022 14:02:17 GMT
Server
Microsoft-IIS/8.0
Content-Length
1245
Content-Type
text/html
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www-logs-banking.canadacentral.cloudapp.azure.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www-logs-banking.canadacentral.cloudapp.azure.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1016 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www-logs-banking.canadacentral.cloudapp.azure.com/
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		48 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c

Request headers

Referer
http://www-logs-banking.canadacentral.cloudapp.azure.com/
Origin
http://www-logs-banking.canadacentral.cloudapp.azure.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		41 KB
41 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d

Request headers

Referer
http://www-logs-banking.canadacentral.cloudapp.azure.com/
Origin
http://www-logs-banking.canadacentral.cloudapp.azure.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11; SM-A102U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

1 Cookies

Domain/Path Name / Value
redinationagermanp.southindia.cloudapp.azure.com/ Name: PHPSESSID
Value: 6qonhi000j4k4e2r9933rl49q3

1 Console Messages

Source Level URL
Text
network error URL: http://www-logs-banking.canadacentral.cloudapp.azure.com/logs/cfabf2e3d52a9380edea/log/meine/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg#icon-info
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block