spsb.vantechdns.com Open in urlscan Pro
172.93.120.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://spsb.vantechdns.com/bpnew/
Submission: On October 28 via automatic, source openphish (October 28th 2024, 1:22:22 pm UTC) — Scanned from CA

Summary HTTP 2 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 172.93.120.153, located in Lenoir, United States and belongs to HOST4GEEKS-LLC, US. The main domain is spsb.vantechdns.com.
TLS certificate: Issued by R10 on October 19th 2024. Valid for: 3 months.

This is the only time spsb.vantechdns.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2	172.93.120.153 172.93.120.153		393960 (HOST4GEEK...) (HOST4GEEKS-LLC)
2	2

2 172.93.120.153 (Lenoir, United States)

ASN393960 (HOST4GEEKS-LLC, US)
PTR: servar.bavilx.ru.com

spsb.vantechdns.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	vantechdns.com spsb.vantechdns.com	705 KB
2	1

	Domain	Requested by
2	spsb.vantechdns.com	spsb.vantechdns.com
2	1

This site contains links to these domains. Also see Links.

Domain
batterysg.com

Subject Issuer	Validity	Valid
spsb.vantechdns.com R10	`2024-10-19` - `2025-01-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spsb.vantechdns.com/bpnew/
Frame ID: 26187978125425E3AB5CD43F1611C2E9
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Espace client - La Banque Postale

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1319 kB
Transfer

1971 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://batterysg.com/faq/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMy4wLjUwNjAuMTE0IFNhZmFyaS81MzcuMzYgRWRnLzEwMy4wLjEyNjQuNjIxOTcuMTUzLjY5LjEyMDIwMjI6SnVsOk1vbg==

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response spsb.vantechdns.com/bpnew/	1 MB 675 KB	2942ms 113ms	Document text/html	172.93.120.153 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://spsb.vantechdns.com/bpnew/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 172.93.120.153 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS servar.bavilx.ru.com Software nginx / Resource Hash `e60ce69a48a93d7205890b69f5db0441fff59fe1fc3b41a4a13f1e0c58d8993b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding br content-type text/html date Mon, 28 Oct 2024 13:22:26 GMT last-modified Thu, 30 Nov 2023 22:03:42 GMT server nginx vary Accept-Encoding Accept-Encoding
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6153992e4fe15daa0a730f0295eb2cebfe6f97d671fcbc7b4aae635d8f17a63a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://spsb.vantechdns.com Referer Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://spsb.vantechdns.com Referer Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	336 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1a5627a97aa8d55f0866a282ca1d226bf320f6f4aed2aeb76936f84460760318` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	jquery.min.js Show response spsb.vantechdns.com/bpnew/fichier/	86 KB 30 KB	72ms 72ms	Script text/javascript	172.93.120.153 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://spsb.vantechdns.com/bpnew/fichier/jquery.min.js Requested by Host: spsb.vantechdns.com URL: https://spsb.vantechdns.com/bpnew/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 172.93.120.153 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS servar.bavilx.ru.com Software nginx / Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://spsb.vantechdns.com/bpnew/ Response headers content-encoding br date Mon, 28 Oct 2024 13:22:27 GMT content-type text/javascript vary Accept-Encoding, Accept-Encoding server nginx last-modified Thu, 30 Nov 2023 22:03:42 GMT
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	10 KB 10 KB		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spsb.vantechdns.com
172.93.120.153
0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e
1a5627a97aa8d55f0866a282ca1d226bf320f6f4aed2aeb76936f84460760318
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
6153992e4fe15daa0a730f0295eb2cebfe6f97d671fcbc7b4aae635d8f17a63a
6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a
a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674
e60ce69a48a93d7205890b69f5db0441fff59fe1fc3b41a4a13f1e0c58d8993b

spsb.vantechdns.com Open in urlscan Pro 172.93.120.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1319 kBTransfer

1971 kBSize

0 Cookies

1 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

spsb.vantechdns.com Open in urlscan Pro
172.93.120.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1319 kB
Transfer

1971 kB
Size

0
Cookies

2 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!