urlscan.io logo urlscan.io
SecurityTrails logo

myposst-deutsch-postl-de.de.cool Open in urlscan Pro
2a00:f48:2000:affe::50  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://s.free.fr/8JCykMkK
Effective URL: https://myposst-deutsch-postl-de.de.cool/dae/
Submission: On September 14 via manual from DE — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 20 HTTP transactions. The main IP is 2a00:f48:2000:affe::50, located in Germany and belongs to TTM, DE. The main domain is myposst-deutsch-postl-de.de.cool.
TLS certificate: Issued by R3 on August 28th 2022. Valid for: 3 months.
This is the only time myposst-deutsch-postl-de.de.cool was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

Apex Domain
Subdomains		 Transfer
18 de.cool
myposst-deutsch-postl-de.de.cool
388 KB
2 free.fr
s.free.fr
434 B
1 gstatic.com
fonts.gstatic.com
27 KB
1 box.tn
mazraa.box.tn
359 B
20 4
Domain Requested by
18 myposst-deutsch-postl-de.de.cool myposst-deutsch-postl-de.de.cool
2 s.free.fr 2 redirects
1 fonts.gstatic.com myposst-deutsch-postl-de.de.cool
1 mazraa.box.tn
20 4

This site contains links to these domains. Also see Links.

Domain
moc.gov.kw
Subject Issuer Validity Valid
mazraa.box.tn
R3		 2022-08-21 -
2022-11-19		 3 months crt.sh
de.cool
R3		 2022-08-28 -
2022-11-26		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://myposst-deutsch-postl-de.de.cool/dae/
Frame ID: 6592F7FE3ADF5A8988B9C95349BF2A54
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Card DetailsCard Details

Page URL History Show full URLs

  1. https://s.free.fr/8JCykMkK HTTP 301
    https://mazraa.box.tn/dede/ Page URL
  2. https://s.free.fr/7YhK9M6h HTTP 301
    https://myposst-deutsch-postl-de.de.cool/dae/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

416 kB
Transfer

892 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s.free.fr/8JCykMkK HTTP 301
    https://mazraa.box.tn/dede/ Page URL
  2. https://s.free.fr/7YhK9M6h HTTP 301
    https://myposst-deutsch-postl-de.de.cool/dae/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://s.free.fr/8JCykMkK HTTP 301
  • https://mazraa.box.tn/dede/

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
mazraa.box.tn/dede/
Redirect Chain
  • https://s.free.fr/8JCykMkK
  • https://mazraa.box.tn/dede/
72 B
359 B 		Document
General
Check archive.org
Download Go to
Full URL
https://mazraa.box.tn/dede/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.210.111.113 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-d73c1fd1.vps.ovh.net
Software
nginx / PHP/7.3.33 PleskLin
Resource Hash
d0fac1b4a682ef7142639810350de68b236aac598f6214e8fd75865d2ceaab19

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
87
content-type
text/html; charset=UTF-8
date
Wed, 14 Sep 2022 08:03:41 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/7.3.33 PleskLin

Redirect headers

Connection
keep-alive
Content-Length
53
Content-Type
application/json
Date
Wed, 14 Sep 2022 08:03:40 GMT
Location
https://mazraa.box.tn/dede/
Server
nginx/1.10.3
Primary Request /
myposst-deutsch-postl-de.de.cool/dae/
Redirect Chain
  • https://s.free.fr/7YhK9M6h
  • https://myposst-deutsch-postl-de.de.cool/dae/
18 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
e3fc9f0cbd548e2d5eed2b4800f0b59ea34a333a51e6f7262accbf621a3af1fc
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://mazraa.box.tn/dede/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

content-encoding
gzip
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Wed, 14 Sep 2022 08:03:41 GMT
server
openresty
vary
Accept-Encoding Accept-Encoding
x-lima-id
atM4WOOVPRFLMjvh70

Redirect headers

Connection
keep-alive
Content-Length
71
Content-Type
application/json
Date
Wed, 14 Sep 2022 08:03:41 GMT
Location
https://myposst-deutsch-postl-de.de.cool/dae/
Server
nginx/1.10.3
default-3-892167529--2124134411.css
myposst-deutsch-postl-de.de.cool/dae/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/css/default-3-892167529--2124134411.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
bd7a17375c7d2649b2457ee2b045c3c75fbcc60919fd307fa6563fba07c576a1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
W/"6fd-5e89bddd741c0"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
at9RI77af6N84J5rWk
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
responsive-default-fba17bacfbd38519b2a43e0664756de293c416f66863c108d9fc3d85b90c3733.css
myposst-deutsch-postl-de.de.cool/dae/css/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/css/responsive-default-fba17bacfbd38519b2a43e0664756de293c416f66863c108d9fc3d85b90c3733.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
fba17bacfbd38519b2a43e0664756de293c416f66863c108d9fc3d85b90c3733
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
W/"3116-5e89bddd741c0"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
atLPVatupiAdAzmj3I
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
blocks.css
myposst-deutsch-postl-de.de.cool/dae/ziko/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/ziko/blocks.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
8851c4eff7c025edc379ed3d6f62dbba14afeb88261ad9bf4e1eb47ca5682a0a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:28 GMT
server
openresty
etag
W/"29a2-5e89bde238d00"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
atYUPGguB0FrJgSxHP
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
application-b183243468889ccac29f50cb91971600b27ab309c289600f0e29f9a77e11b2b4.js.download
myposst-deutsch-postl-de.de.cool/dae/css/ 		200 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/css/application-b183243468889ccac29f50cb91971600b27ab309c289600f0e29f9a77e11b2b4.js.download
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
b183243468889ccac29f50cb91971600b27ab309c289600f0e29f9a77e11b2b4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
W/"31eb3-5e89bddd741c0"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
x-lima-id
at6ghrwh6XRUBWaH9p
cache-control
max-age=604800
content-security-policy
upgrade-insecure-requests
expires
Wed, 21 Sep 2022 08:03:41 GMT
js
myposst-deutsch-postl-de.de.cool/dae/css/ 		37 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/css/js
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
4612734303c80042ce49b5d1884b673bc6a9ee1db944b9291355cc98352ce666
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
"93cc-5e89bddd741c0"
x-lima-id
atcR4oTxO0rn42M1TF
date
Wed, 14 Sep 2022 08:03:41 GMT
accept-ranges
bytes
content-length
37836
formidableforms.css
myposst-deutsch-postl-de.de.cool/dae/ziko/ 		81 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/ziko/formidableforms.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
1d56d600bd57e7f0010559bd34feb2eb466fcc854a8931d7f51a4e1c9a81609a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:11 GMT
server
openresty
etag
W/"1443c-5e89bdd2026c0"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
atCsSBXmECMjjLZC1d
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
css
myposst-deutsch-postl-de.de.cool/dae/ziko/ 		9 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/ziko/css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
36e85f657d8383b420405d8e6de4cff07af9225aebd2495aea21db3bfd0e1895
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
last-modified
Wed, 14 Sep 2022 04:50:28 GMT
server
openresty
etag
"23d4-5e89bde238d00"
x-lima-id
atV1lUoyAyPnqmuw7J
date
Wed, 14 Sep 2022 08:03:41 GMT
accept-ranges
bytes
content-length
9172
style.css
myposst-deutsch-postl-de.de.cool/dae/ziko/ 		86 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/ziko/style.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
e265caceadd7c84293dbcc22595c31f5cc175773c7155bbbb59d82185f2766b5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:28 GMT
server
openresty
etag
W/"1599c-5e89bde238d00"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
ataKESgUdH3JuLiuU0
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
combined.min.css
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		39 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/combined.min.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
2b2199879955cb927cac9e685fe1357c13b63a7f26aff3d0e894b13b54698fbc
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
W/"9a92-5e89bddd741c0"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
atQGE9hxToFXH2Ul45
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
public.min.css
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/public.min.css
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
079f69d9f24e528516e09a5b9f87285b1801ce1dd4aa8155b848ead91b668939
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:15 GMT
server
openresty
etag
W/"14da-5e89bdd5d2fc0"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
at5n03ARPp3Q2Wp3bm
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Fri, 14 Oct 2022 08:03:41 GMT
postdede.gif
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/postdede.gif
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
1ba49cb7dc050a76b4d2f96c98fa5c8a0c48481e68629cb0ada97f848b73460e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
"745e-5e89bddd741c0"
content-type
image/gif
x-lima-id
atuTLhlXPbZ4ZAn3zP
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
accept-ranges
bytes
content-length
29790
expires
Fri, 14 Oct 2022 08:03:41 GMT
lok1.png
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		124 KB
124 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/lok1.png
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
b3df0c975a08d43918c6844bf3f6783c29f68080067dcdda2bcb2d9e9c49c62c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
last-modified
Wed, 14 Sep 2022 04:50:15 GMT
server
openresty
etag
"1efb9-5e89bdd5d2fc0"
content-type
image/png
x-lima-id
atkzSdDSUhIEl2iN9q
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
accept-ranges
bytes
content-length
126905
expires
Fri, 14 Oct 2022 08:03:41 GMT
jquery-3.1.1.slim.min.js
myposst-deutsch-postl-de.de.cool/dae/asset/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/asset/jquery-3.1.1.slim.min.js
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty / PHP/7.4.30
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
server
openresty
x-powered-by
PHP/7.4.30
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
x-lima-id
atb5QlrtWmdrzCV993
cache-control
no-cache, must-revalidate, max-age=0
content-security-policy
upgrade-insecure-requests
link
<https://myposst-deutsch-postl-de.de.cool/wp-json/>; rel="https://api.w.org/"
expires
Wed, 11 Jan 1984 05:00:00 GMT
pin-basic.svg
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/pin-basic.svg
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
aa445439f4c3bc0aa0c7daffd10de0761f28493bb02416307a7a0f61ab2a7494
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
W/"e69-5e89bddd741c0"
vary
Accept-Encoding
content-type
image/svg+xml
x-lima-id
at1b3iC4LIaNDtEBTi
content-security-policy
upgrade-insecure-requests
combined.min.js.download
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		205 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/combined.min.js.download
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
1c88b04b90105031ea77462774c3ef2570e95ad4e94eaccf701e3ba2c3c8110a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://myposst-deutsch-postl-de.de.cool/dae/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
W/"335c4-5e89bddd741c0"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
x-lima-id
atIta4SIbTrW9lsveT
cache-control
max-age=604800
content-security-policy
upgrade-insecure-requests
expires
Wed, 21 Sep 2022 08:03:41 GMT
hpp-icons.ttf
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/hpp-icons.ttf?idbrji
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/combined.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty / PHP/7.4.30
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/combined.min.css
Origin
https://myposst-deutsch-postl-de.de.cool
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
content-encoding
gzip
server
openresty
x-powered-by
PHP/7.4.30
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
x-lima-id
atWm6zbesYa8NCyKhe
cache-control
no-cache, must-revalidate, max-age=0
content-security-policy
upgrade-insecure-requests
link
<https://myposst-deutsch-postl-de.de.cool/wp-json/>; rel="https://api.w.org/"
expires
Wed, 11 Jan 1984 05:00:00 GMT
jizDREVItHgc8qDIbSTKq4XkRiUf2zc.woff2
fonts.gstatic.com/s/librefranklin/v6/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/librefranklin/v6/jizDREVItHgc8qDIbSTKq4XkRiUf2zc.woff2
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/ziko/css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fedcdc389419bfa88ed3f2c226b9d043fa6d6ea927cadd49c833cbfcf0de3efb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://myposst-deutsch-postl-de.de.cool/
Origin
https://myposst-deutsch-postl-de.de.cool
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 08 Sep 2022 19:37:27 GMT
x-content-type-options
nosniff
age
476774
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27240
x-xss-protection
0
last-modified
Thu, 05 Nov 2020 22:03:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Sep 2023 19:37:27 GMT
hpp-icons.woff
myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/ 		4 KB
4 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/hpp-icons.woff?idbrji
Requested by
Host: myposst-deutsch-postl-de.de.cool
URL: https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/combined.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
b94922aa1f20a3ddc3f53ffbd30bb3f9e329c05dece83fa668c2430ec01475e8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/combined.min.css
Origin
https://myposst-deutsch-postl-de.de.cool
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 14 Sep 2022 08:03:41 GMT
last-modified
Wed, 14 Sep 2022 04:50:23 GMT
server
openresty
etag
"1120-5e89bddd741c0"
content-type
application/font-woff
x-lima-id
atnAyniEciqwMlyFE8
content-security-policy
upgrade-insecure-requests
accept-ranges
bytes
content-length
4384

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

92 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| LiveValidation function| LiveValidationForm object| Validate object| RsaOaep function| $ function| jQuery object| MATCH_X_CHARACTERS object| supported_cards object| ranked_card_types boolean| card_detection_available boolean| mask_sensitive_account_data boolean| always_display_cvn boolean| always_require_cvn string| card_number_orig string| card_cvn_orig boolean| echeck_enabled string| echeck_account_number_orig string| echeck_routing_number_orig string| currency object| card_type_presence_params object| t object| card_brand_names undefined| card_expiry_year_validator undefined| card_expiry_month_validator undefined| card_number_validator undefined| card_cvn_validator undefined| card_cvn_presence_validator_params undefined| card_cvn_length_validator_params object| card_type_validator_radio_buttons undefined| card_type_validator_drop_down undefined| echeckFields undefined| echeck_routing_number_validator undefined| echeck_account_number_validator undefined| echeck_check_number_validator undefined| echeck_account_type_validator undefined| date_of_birth_month_validator undefined| date_of_birth_day_validator undefined| date_of_birth_year_validator undefined| driver_license_number_validator undefined| driver_license_state_validator undefined| company_tax_id_validator function| strip_spaces function| checkLuhn function| validate_expiry_date function| validate_date_of_birth function| isBlank function| isNotBlank function| getCurrentCardType function| set_cvn_display function| set_cvn_required function| set_jpo_method_display function| set_jpo_installments function| initialize_card function| initializeCardDetection function| initializeECheck function| maskAll function| maskAllButLastFour function| init_masking object| sessionTimer function| displayTerms function| isIE undefined| fallbackAlertFunction object| worldpay object| thmx function| worldpayHppRecaptchaRender object| WP object| html5 object| respond function| setAttr function| getAttr string| defaultCardNumberGrouping string| defaultCardNumberSeparator number| minDigitsToUseForCardTypeCheck string| attrPrefix function| doCheck function| queue function| queueCancel function| send function| sendToHpp function| cacheFetch function| cacheStore function| handleResult object| utils

6 Cookies

Domain/Path Name / Value
myposst-deutsch-postl-de.de.cool/dae Name: test
Value: 1
myposst-deutsch-postl-de.de.cool/dae Name:
Value: null
mazraa.box.tn/ Name: PHPSESSID
Value: tckgebsh9mmkhlfbhgaamctn97
myposst-deutsch-postl-de.de.cool/ Name: _lcp
Value: a
myposst-deutsch-postl-de.de.cool/ Name: _lcp2
Value: a
myposst-deutsch-postl-de.de.cool/ Name: _lcp3
Value: a

2 Console Messages

Source Level URL
Text
network error URL: https://myposst-deutsch-postl-de.de.cool/dae/asset/jquery-3.1.1.slim.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://myposst-deutsch-postl-de.de.cool/dae/Card%20Details_files/hpp-icons.ttf?idbrji
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
mazraa.box.tn
myposst-deutsch-postl-de.de.cool
s.free.fr
2a00:1450:4001:82b::2003
2a00:f48:2000:affe::50
2a01:e0c:1:1599::29
51.210.111.113
079f69d9f24e528516e09a5b9f87285b1801ce1dd4aa8155b848ead91b668939
1ba49cb7dc050a76b4d2f96c98fa5c8a0c48481e68629cb0ada97f848b73460e
1c88b04b90105031ea77462774c3ef2570e95ad4e94eaccf701e3ba2c3c8110a
1d56d600bd57e7f0010559bd34feb2eb466fcc854a8931d7f51a4e1c9a81609a
2b2199879955cb927cac9e685fe1357c13b63a7f26aff3d0e894b13b54698fbc
36e85f657d8383b420405d8e6de4cff07af9225aebd2495aea21db3bfd0e1895
4612734303c80042ce49b5d1884b673bc6a9ee1db944b9291355cc98352ce666
8851c4eff7c025edc379ed3d6f62dbba14afeb88261ad9bf4e1eb47ca5682a0a
aa445439f4c3bc0aa0c7daffd10de0761f28493bb02416307a7a0f61ab2a7494
b183243468889ccac29f50cb91971600b27ab309c289600f0e29f9a77e11b2b4
b3df0c975a08d43918c6844bf3f6783c29f68080067dcdda2bcb2d9e9c49c62c
b94922aa1f20a3ddc3f53ffbd30bb3f9e329c05dece83fa668c2430ec01475e8
bd7a17375c7d2649b2457ee2b045c3c75fbcc60919fd307fa6563fba07c576a1
d0fac1b4a682ef7142639810350de68b236aac598f6214e8fd75865d2ceaab19
e265caceadd7c84293dbcc22595c31f5cc175773c7155bbbb59d82185f2766b5
e3fc9f0cbd548e2d5eed2b4800f0b59ea34a333a51e6f7262accbf621a3af1fc
fba17bacfbd38519b2a43e0664756de293c416f66863c108d9fc3d85b90c3733
fedcdc389419bfa88ed3f2c226b9d043fa6d6ea927cadd49c833cbfcf0de3efb