dal-business-26.hostwindsdns.com
Open in
urlscan Pro
23.254.251.158
Malicious Activity!
Public Scan
Submission: On February 24 via api from US — Scanned from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 23rd 2023. Valid for: 3 months.
This is the only time dal-business-26.hostwindsdns.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Postbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
13 | 23.254.251.158 23.254.251.158 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
14 | 2 |
ASN54290 (HOSTWINDS, US)
PTR: dal-business-26.hostwindsdns.com
dal-business-26.hostwindsdns.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
hostwindsdns.com
dal-business-26.hostwindsdns.com |
376 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 693 |
30 KB |
14 | 2 |
Domain | Requested by | |
---|---|---|
13 | dal-business-26.hostwindsdns.com |
dal-business-26.hostwindsdns.com
|
1 | code.jquery.com |
dal-business-26.hostwindsdns.com
|
14 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dal-business-26.hostwindsdns.com cPanel, Inc. Certification Authority |
2023-01-23 - 2023-04-23 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/index.php?login=7FRGUB26IuqWxXuBZQN42SeWfRblDM
Frame ID: BBFA6FC0A46220E7FA1A3D02BC49AD63
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Login - Postbank Banking & BrokerageDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/ |
38 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/js/ |
86 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ss.css
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/css/ |
364 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cmp.min.css
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/css/ |
25 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ss.css
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/css/ |
364 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.production.sha256-374570626d2f6d6a7146467049795a592b54516e774f636a384a636b6343304d754367575a7170657866343d.css
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/css/ |
2 KB 546 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.production.sha256-746847444851506954686c455a76633838354a2f6342774e6d336c304c55714b6b414457337875573965733d.css
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/css/ |
365 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/img/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo-claim.svg
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/img/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sicherheitshinweis.jpg
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/img/ |
113 KB 113 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logogray.svg
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/img/ |
1016 B 567 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font1
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/fonts/ |
48 KB 48 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font2
dal-business-26.hostwindsdns.com/~islsqjkm/de/de1/files/fonts/ |
41 KB 41 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Postbank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dal-business-26.hostwindsdns.com/ | Name: PHPSESSID Value: fe85079495304d87ee98ffb157e2a8d9 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
dal-business-26.hostwindsdns.com
2001:4de0:ac18::1:a:1b
23.254.251.158
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d
3e75c07497549bc82f652265b74500071ec759dd0c4775574477c326760b9899
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20
91a5efcddcef7a69a94bac9f5fd3a15f6bfdd4792675db1a1e4c179ea7f9ecd3
b611831d03e24e194466f73cf3927f701c0d9b79742d4a8a9000d6df1b96f5eb
b6fee381207d08fa8d029741f93662cf29622bb040a5d875bab0d68a1e93e6df
ec4a5b9bf9a3a85169232658f93427c0e723f09724702d0cb8281666aa5ec5fe
ef39cbaed5773b07f7a352d609b7d13cce626c275779328e14a346369ac06123
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b