postal-cleint0124.rapport-1gouv.com.do

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 185.220.113.204, located in Erbil, Iraq and belongs to ZANA-COMPANY, IQ. The main domain is postal-cleint0124.rapport-1gouv.com.do.
TLS certificate: Issued by R3 on September 12th 2023. Valid for: 3 months.

This is the only time postal-cleint0124.rapport-1gouv.com.do was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 4	185.220.113.204 185.220.113.204		205371 (ZANA-COMPANY) (ZANA-COMPANY)
3	2

4 185.220.113.204 (Erbil, Iraq) 1 redirects

ASN205371 (ZANA-COMPANY, IQ)

postal-cleint0124.rapport-1gouv.com.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	rapport-1gouv.com.do 1 redirects postal-cleint0124.rapport-1gouv.com.do	736 KB
3	1

	Domain	Requested by
4	postal-cleint0124.rapport-1gouv.com.do	1 redirects postal-cleint0124.rapport-1gouv.com.do
3	1

This site contains links to these domains. Also see Links.

Domain
verif-lbp.fr

Subject Issuer	Validity	Valid
postal-cleint0124.rapport-1gouv.com.do R3	`2023-09-12` - `2023-12-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947
Frame ID: B02B4B4A657A6A5127216F0AFBA78774
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Connexion à l'espace client - La Banque Postale

Page URL History Show full URLs

https://postal-cleint0124.rapport-1gouv.com.do/ HTTP 302
https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fd... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1350 kB
Transfer

2188 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://verif-lbp.fr/pstl-log.php

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://postal-cleint0124.rapport-1gouv.com.do/ HTTP 302
https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response postal-cleint0124.rapport-1gouv.com.do/app/ Redirect Chain https://postal-cleint0124.rapport-1gouv.com.do/ https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947	1 MB 694 KB	845ms 845ms	Document text/html	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Full URL https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PHP/8.0.30 PleskLin Resource Hash `8fadd4964614a7d8ccd81077476c09498e4e8616dc9392db3a63a75f725ff62c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 12 Sep 2023 08:32:19 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding x-powered-by PHP/8.0.30 PleskLin Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Tue, 12 Sep 2023 08:32:18 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 pragma no-cache server nginx x-powered-by PHP/8.0.30 PleskLin
GET H2	200	logo-lbp.png postal-cleint0124.rapport-1gouv.com.do/app/assets/	8 KB 9 KB	91ms 90ms	Image image/png	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Show image Full URL https://postal-cleint0124.rapport-1gouv.com.do/app/assets/logo-lbp.png Requested by Host: postal-cleint0124.rapport-1gouv.com.do URL: https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PleskLin Resource Hash `c6573f8959e56e6a621715af791a527f3da7dc0c1abd9377b83f991ccc85a91c` Request headers accept-language de-DE,de;q=0.9 Referer https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Tue, 12 Sep 2023 08:32:21 GMT last-modified Wed, 05 Apr 2023 12:34:00 GMT server nginx etag "642d6ab8-21d8" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 8664
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e` Request headers Referer Origin https://postal-cleint0124.rapport-1gouv.com.do accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type application/x-font-woff
GET DATA	200 OK	truncated /	302 KB 302 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e` Request headers Referer Origin https://postal-cleint0124.rapport-1gouv.com.do accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type application/x-font-woff
GET H2	200	jquery.min.js Show response postal-cleint0124.rapport-1gouv.com.do/app/assets/	127 KB 33 KB	95ms 95ms	Script application/javascript	185.220.113.204 ZANA-COMPANY
General Check archive.org Show headers Download Go to Full URL https://postal-cleint0124.rapport-1gouv.com.do/app/assets/jquery.min.js Requested by Host: postal-cleint0124.rapport-1gouv.com.do URL: https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.220.113.204 Erbil, Iraq, ASN205371 (ZANA-COMPANY, IQ), Reverse DNS Software nginx / PleskLin Resource Hash `cd87a5b22efec1853e85f17119beb43ee5f805b1b64feabf2e13f85058d263a1` Request headers accept-language de-DE,de;q=0.9 Referer https://postal-cleint0124.rapport-1gouv.com.do/app/index.php?&userid=4e26ad3e5670c9b962292837b06b6ff9&ue=f867e1c7fd616951fdc0b40a34177947 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Tue, 12 Sep 2023 08:32:21 GMT content-encoding br last-modified Wed, 05 Apr 2023 16:10:14 GMT server nginx etag W/"642d9d66-1fa12" x-powered-by PleskLin content-type application/javascript
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	10 KB 10 KB		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			postal-cleint0124.rapport-1gouv.com.do/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0t5e66ml1kgb9dcoq0bg82sgqn

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

postal-cleint0124.rapport-1gouv.com.do
185.220.113.204
0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a
8fadd4964614a7d8ccd81077476c09498e4e8616dc9392db3a63a75f725ff62c
a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674
c6573f8959e56e6a621715af791a527f3da7dc0c1abd9377b83f991ccc85a91c
cd87a5b22efec1853e85f17119beb43ee5f805b1b64feabf2e13f85058d263a1

postal-cleint0124.rapport-1gouv.com.do Open in urlscan Pro 185.220.113.204 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1350 kBTransfer

2188 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

postal-cleint0124.rapport-1gouv.com.do Open in urlscan Pro
185.220.113.204 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1350 kB
Transfer

2188 kB
Size

1
Cookies

3 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!