urlscan.io logo urlscan.io
SecurityTrails logo

posten.jdevcloud.com Open in urlscan Pro
2607:1b00:93b2:e42c::2b7e  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
Submission: On April 23 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 2607:1b00:93b2:e42c::2b7e, located in United States and belongs to CLOUDACCESS-NETWORK, US. The main domain is posten.jdevcloud.com.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on October 4th 2021. Valid for: a year.
This is the only time posten.jdevcloud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

IP Address AS Autonomous System
2 2607:1b00:93b... 54456 (CLOUDACCE...)
1 199.116.76.138 54456 (CLOUDACCE...)
3 3
Apex Domain
Subdomains		 Transfer
3 jdevcloud.com
posten.jdevcloud.com
24 KB
3 1
Domain Requested by
3 posten.jdevcloud.com posten.jdevcloud.com
3 1

This site contains no links.

Subject Issuer Validity Valid
*.jdevcloud.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2021-10-04 -
2022-11-04		 a year crt.sh

This page contains 1 frames:

Primary Page: https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
Frame ID: 9110AF363F1D5BB5B88B36BB070E06B4
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

BankID - Identifisering

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

24 kB
Transfer

154 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request a.htm
posten.jdevcloud.com/mzkzn/nopost/js/ 		23 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2607:1b00:93b2:e42c::2b7e , United States, ASN54456 (CLOUDACCESS-NETWORK, US),
Reverse DNS
Software
Apache /
Resource Hash
896e83fe6d9c07284bc524873038e183033415b6a383905f9961a24b45b5f348

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
4481
Content-Type
text/html; charset=UTF-8
Date
Sat, 23 Apr 2022 02:02:49 GMT
Keep-Alive
timeout=60
Last-Modified
Thu, 21 Apr 2022 13:25:44 GMT
Server
Apache
Vary
Accept-Encoding
bid_202201130932.css
posten.jdevcloud.com/mzkzn/nopost/js/a_data/ 		129 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://posten.jdevcloud.com/mzkzn/nopost/js/a_data/bid_202201130932.css
Requested by
Host: posten.jdevcloud.com
URL: https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2607:1b00:93b2:e42c::2b7e , United States, ASN54456 (CLOUDACCESS-NETWORK, US),
Reverse DNS
Software
Apache /
Resource Hash
68865208ac1cc3b9a6a8bf2e7a8c6e95d90be33bbfd73bb9c682034199f176a4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 02:02:49 GMT
Content-Encoding
gzip
Last-Modified
Thu, 21 Apr 2022 13:25:44 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
18581
error.js
posten.jdevcloud.com/mzkzn/nopost/js/a_data/ 		305 B
493 B 		Script
General
Check archive.org
Download Go to
Full URL
https://posten.jdevcloud.com/mzkzn/nopost/js/a_data/error.js
Requested by
Host: posten.jdevcloud.com
URL: https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.116.76.138 , United States, ASN54456 (CLOUDACCESS-NETWORK, US),
Reverse DNS
lamp121.cloudaccess.net
Software
Apache /
Resource Hash
a63fb9da878b0ec21899ca5a9a208a28514577810e581a72643cdd4762113e39

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://posten.jdevcloud.com/mzkzn/nopost/js/a.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 02:02:49 GMT
Content-Encoding
gzip
Last-Modified
Thu, 21 Apr 2022 13:25:44 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
206
truncated
/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
text/javascript
truncated
/ 		172 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a191c4d1f4adbef09018df519205cc8696e1f0f00a67196f0677e8484d949f2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		167 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cbee76f080a3f8638f8d1cc0e1457adf5588a5ca44b56c5bf719bb5f57f0f2de

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		192 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
347026e609df7b4c783cbb5af4b7e65d899b71bdfd9b99de75fbf63a033ea74f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		760 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		494 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e356f94cb14b1e3c53975eb33c18f36f0c9dd1b4866940d6e243d2063546fa30

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		172 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		296 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
296d8f67dcf848a35385d138a46404f00c21f1a8eb22249473ddd9aab1f411ab

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		310 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c575ff79d199955e3aba19296142cf49cd7bcdcf7317f8a17bed8d349f9a7388

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		200 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dc197b30cca0477fd82b1c175af0ed1008687e12d9dff7f75c417f959c1830ae

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| eb boolean| feKuyui_vaofLUTJVTKX_1

0 Cookies