URL: http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
Submission Tags: public
Submission: On February 08 via api from AU — Scanned from AU

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 200.58.111.19, located in Rosario, Argentina and belongs to Dattatec.com, AR. The main domain is ngfinder.com.ar.
This is the only time ngfinder.com.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
3 200.58.111.19 27823 (Dattatec.com)
3 2
Apex Domain
Subdomains
Transfer
3 ngfinder.com.ar
ngfinder.com.ar
2 MB
3 1
Domain Requested by
3 ngfinder.com.ar ngfinder.com.ar
3 1

This site contains links to these domains. Also see Links.

Domain
www.postbank.de
meine.postbank.de
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
Frame ID: C1E5AFECD3F096AE1BA34BEC8D84F0BD
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Login - Postbank Banking & Brokerage

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1773 kB
Transfer

2456 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
2 MB
2 MB
Document
General
Full URL
http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
Protocol
HTTP/1.1
Server
200.58.111.19 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS
mexico.dattaweb.com
Software
Apache /
Resource Hash
0834dd8463f6e8724e993fac5fc389a82d803ea0992d4fa7a49c3cdcab6b83a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
accept-language
en-AU,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
1722551
Content-Type
text/html
Date
Wed, 08 Feb 2023 20:35:09 GMT
ETag
"1a48b7-5f41ac26fff00"
Keep-Alive
timeout=10, max=200
Last-Modified
Tue, 07 Feb 2023 11:50:52 GMT
Server
Apache
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44a485e43d7c032784496d17e884bdc41683d3ad3d9999287fa848a2f698ac20

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
image/svg+xml
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe5103f855975085f28d2a255145a386f30d2afe2a1b26fa9943d74b54859b7b

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
image/svg+xml
truncated
/
1016 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2b46a500fcaaee5c95cbe3ebeb539f6f9a7a14978387f696ab6f092838e9c920

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
image/svg+xml
truncated
/
41 KB
41 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33f227be2f5d1077c023bf5bfaa69f4498c74c3771d820ac23e2e2ca2a2bcd0d

Request headers

Referer
http://ngfinder.com.ar/
Origin
http://ngfinder.com.ar
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
font/woff2
truncated
/
48 KB
48 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0392b37cafa1d3eaf5f00c2594df53bea1f7c7059180098d4185a2425d580d1c

Request headers

Referer
http://ngfinder.com.ar/
Origin
http://ngfinder.com.ar
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
font/woff2
svg-icon-sprite.svg
ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/
0
0
Other
General
Full URL
http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg
Requested by
Host: ngfinder.com.ar
URL: http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
Protocol
HTTP/1.1
Server
200.58.111.19 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS
mexico.dattaweb.com
Software
Apache /
Resource Hash

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Date
Wed, 08 Feb 2023 20:35:15 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=10, max=200
Content-Length
320
Content-Type
text/html; charset=iso-8859-1
renice.png
ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/index_files/
1 KB
2 KB
Image
General
Full URL
http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/index_files/renice.png
Requested by
Host: ngfinder.com.ar
URL: http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
Protocol
HTTP/1.1
Server
200.58.111.19 Rosario, Argentina, ASN27823 (Dattatec.com, AR),
Reverse DNS
mexico.dattaweb.com
Software
Apache /
Resource Hash
51d40e4685c1f1d0ca78b4a51b409de899a4d7b631c03ea44e64b048e7e24b85

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Date
Wed, 08 Feb 2023 20:35:15 GMT
Last-Modified
Tue, 07 Feb 2023 11:50:52 GMT
Server
Apache
ETag
"55d-5f41ac26fff00"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=10, max=199
Content-Length
1373
truncated
/
612 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
545d99b57daa48a5fd7781e1ace4be2422a069625a8c71924d2a245998755df7

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
image/jpeg
truncated
/
15 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2afc1ff4a798ce317d694abd9ecb5dc5f7e1211f80e3864902c0f6da65746c14

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
image/jpeg
truncated
/
50 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1dba4aed649c01e3a9864ed3313c4b506525c74e107760f113b31dc044a0f452

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://ngfinder.com.ar/
User-Agent
Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Response headers

Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| savepage_ShadowLoader

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: http://ngfinder.com.ar/fonts/herdposrt/postbanknew/postbanknew/4mtllngy=/bundles/@pbs/patternlib_pb/lib/runtime/assets/images/svg-icon-sprite.svg#icon-info
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)