urlscan.io logo urlscan.io
SecurityTrails logo

www.brossard.fr Open in urlscan Pro
92.222.255.42  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://url511.conquercomputing.com/ls/click?upn=W28Vdd2BYB8Uxq2iHxc7XGMuAzZ-2BSwXKo2ONSPP28jTj03U08cvIX87QKK1yAxU2tOyk8q3ZM7qW5bNKy...
Effective URL: https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Submission: On August 29 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 92.222.255.42, located in Paris, France and belongs to OVH, FR. The main domain is www.brossard.fr.
TLS certificate: Issued by Sectigo ECC Organization Validation S... on August 17th 2021. Valid for: a year.
This is the only time www.brossard.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.52 11377 (SENDGRID)
1 1 67.225.163.44 32244 (LIQUIDWEB)
1 104.244.42.69 13414 (TWITTER)
3 6 92.222.255.42 16276 (OVH)
4 3
Apex Domain
Subdomains		 Transfer
6 brossard.fr
www.brossard.fr
962 KB
1 t.co
t.co — Cisco Umbrella Rank: 489
537 B
1 melinuxgood.com
test.melinuxgood.com
188 B
1 conquercomputing.com
url511.conquercomputing.com
248 B
4 4
Domain Requested by
6 www.brossard.fr 3 redirects t.co
www.brossard.fr
1 t.co
1 test.melinuxgood.com 1 redirects
1 url511.conquercomputing.com 1 redirects
4 4

This site contains links to these domains. Also see Links.

Domain
www.postbank.de
meine.postbank.de
Subject Issuer Validity Valid
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
www.brossard.fr
Sectigo ECC Organization Validation Secure Server CA		 2021-08-17 -
2022-09-17		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Frame ID: 604C813302459F9A440A79FF66AD9E39
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login - Postbank Banking & Brokerage

Page URL History Show full URLs

  1. http://url511.conquercomputing.com/ls/click?upn=W28Vdd2BYB8Uxq2iHxc7XGMuAzZ-2BSwXKo2ONSPP28jTj03U08cvIX87QKK1yA... HTTP 302
    https://test.melinuxgood.com/wp-admin/k/k.php HTTP 302
    https://t.co/bs8KIHN7qa Page URL
  2. https://www.brossard.fr/wp-admin/user/postbanknew/luke.php HTTP 302
    https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/?22d11d3a HTTP 302
    https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq= HTTP 301
    https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

1051 kB
Transfer

2456 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://url511.conquercomputing.com/ls/click?upn=W28Vdd2BYB8Uxq2iHxc7XGMuAzZ-2BSwXKo2ONSPP28jTj03U08cvIX87QKK1yAxU2tOyk8q3ZM7qW5bNKyveCWQ-3D-3D09mg_3rTnOPLHSpWmsCOeGTrRsUflX5O7tc0MfSYH-2B4H1BXicv337gEhkoV4XhR5bcIoa-2FySDxHL2u8ZK87oNjm-2B8GH5xjNbUUV2WXRbPcgbChYnUOyCWPre-2FTS0xJs0lDSWZ1-2B9eyQ-2BTqTTV0V1aXCUkQNbQM3n4vDfG0R4dgF-2F5hgK5r-2F61BnH84B-2BnomYSy4gqFPpN5v6TpkswR01A7VUtTQ-3D-3D HTTP 302
    https://test.melinuxgood.com/wp-admin/k/k.php HTTP 302
    https://t.co/bs8KIHN7qa Page URL
  2. https://www.brossard.fr/wp-admin/user/postbanknew/luke.php HTTP 302
    https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/?22d11d3a HTTP 302
    https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq= HTTP 301
    https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://url511.conquercomputing.com/ls/click?upn=W28Vdd2BYB8Uxq2iHxc7XGMuAzZ-2BSwXKo2ONSPP28jTj03U08cvIX87QKK1yAxU2tOyk8q3ZM7qW5bNKyveCWQ-3D-3D09mg_3rTnOPLHSpWmsCOeGTrRsUflX5O7tc0MfSYH-2B4H1BXicv337gEhkoV4XhR5bcIoa-2FySDxHL2u8ZK87oNjm-2B8GH5xjNbUUV2WXRbPcgbChYnUOyCWPre-2FTS0xJs0lDSWZ1-2B9eyQ-2BTqTTV0V1aXCUkQNbQM3n4vDfG0R4dgF-2F5hgK5r-2F61BnH84B-2BnomYSy4gqFPpN5v6TpkswR01A7VUtTQ-3D-3D HTTP 302
  • https://test.melinuxgood.com/wp-admin/k/k.php HTTP 302
  • https://t.co/bs8KIHN7qa

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
bs8KIHN7qa
t.co/
Redirect Chain
  • http://url511.conquercomputing.com/ls/click?upn=W28Vdd2BYB8Uxq2iHxc7XGMuAzZ-2BSwXKo2ONSPP28jTj03U08cvIX87QKK1yAxU2tOyk8q3ZM7qW5bNKyveCWQ-3D-3D09mg_3rTnOPLHSpWmsCOeGTrRsUflX5O7tc0MfSYH-2B4H1BXicv337...
  • https://test.melinuxgood.com/wp-admin/k/k.php
  • https://t.co/bs8KIHN7qa
332 B
537 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/bs8KIHN7qa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,max-age=300
content-encoding
gzip
content-length
205
content-type
text/html; charset=utf-8
date
Mon, 29 Aug 2022 07:25:57 GMT
expires
Mon, 29 Aug 2022 07:30:57 GMT
server
tsa_o
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
150cf078d73f647089da251c5fed6b8c3df081efe264b6e5477085f4e786215c
x-response-time
114
x-xss-protection
0

Redirect headers

Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 29 Aug 2022 07:25:57 GMT
Location
https://t.co/bs8KIHN7qa
Server
Apache
Primary Request /
www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Redirect Chain
  • https://www.brossard.fr/wp-admin/user/postbanknew/luke.php
  • https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/?22d11d3a
  • https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=
  • https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
2 MB
960 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Requested by
Host: t.co
URL: https://t.co/bs8KIHN7qa
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
92.222.255.42 Paris, France, ASN16276 (OVH, FR),
Reverse DNS
brossard.brossard.fr
Software
Apache / WP Rocket/3.2.0.1
Resource Hash
0834dd8463f6e8724e993fac5fc389a82d803ea0992d4fa7a49c3cdcab6b83a4

Request headers

Referer
https://t.co/bs8KIHN7qa
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=0, public
Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 29 Aug 2022 07:25:58 GMT
Expires
Mon, 29 Aug 2022 07:25:58 GMT
Keep-Alive
timeout=5, max=97
Server
Apache
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Powered-By
WP Rocket/3.2.0.1

Redirect headers

Cache-Control
max-age=0
Connection
Keep-Alive
Content-Length
280
Content-Type
text/html; charset=iso-8859-1
Date
Mon, 29 Aug 2022 07:25:58 GMT
Expires
Mon, 29 Aug 2022 07:25:58 GMT
Keep-Alive
timeout=5, max=98
Location
https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Server
Apache
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1016 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		41 KB
41 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d

Request headers

Referer
Origin
https://www.brossard.fr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		48 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c

Request headers

Referer
Origin
https://www.brossard.fr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
font/woff2
svg-icon-sprite.svg
www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg
Requested by
Host: www.brossard.fr
URL: https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
92.222.255.42 Paris, France, ASN16276 (OVH, FR),
Reverse DNS
brossard.brossard.fr
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date
Mon, 29 Aug 2022 07:25:59 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<https://www.brossard.fr/wp-json/>; rel="https://api.w.org/"
Content-Length
8715
Keep-Alive
timeout=5, max=96
Expires
Wed, 11 Jan 1984 05:00:00 GMT
renice.png
www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/index_files/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/index_files/renice.png
Requested by
Host: www.brossard.fr
URL: https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
92.222.255.42 Paris, France, ASN16276 (OVH, FR),
Reverse DNS
brossard.brossard.fr
Software
Apache /
Resource Hash
51d40e4685c1f1d0ca78b4a51b409de899a4d7b631c03ea44e64b048e7e24b85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date
Mon, 29 Aug 2022 07:25:59 GMT
Last-Modified
Mon, 29 Aug 2022 07:25:58 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=2592000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1373
Expires
Wed, 28 Sep 2022 07:25:59 GMT
truncated
/ 		612 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
545d99b57daa48a5fd7781e1ace4be2422a069625a8c71924d2a245998755df7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		15 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		50 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1dba4aed649c01e3a9864ed3313c4b506525c74e107760f113b31dc044a0f452

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| savepage_ShadowLoader

1 Cookies

Domain/Path Name / Value
.t.co/ Name: muc
Value: 42997d3a-dbff-4294-811c-782db6bdccad

1 Console Messages

Source Level URL
Text
network error URL: https://www.brossard.fr/wp-admin/user/postbanknew/postbanknew/zywy4mjq=/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg#icon-info
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0