epstbnkbg.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 185.80.129.168, located in Lithuania and belongs to VPSNET-AS UAB ESNET, LT. The main domain is epstbnkbg.com.
TLS certificate: Issued by R11 on November 16th 2024. Valid for: 3 months.

This is the only time epstbnkbg.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: E Postbank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
6	185.80.129.168 185.80.129.168		61053 (VPSNET-AS...) (VPSNET-AS UAB ESNET)
6	1

6 185.80.129.168 (Lithuania)

ASN61053 (VPSNET-AS UAB ESNET, LT)

epstbnkbg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	epstbnkbg.com epstbnkbg.com	614 KB
6	1

	Domain	Requested by
6	epstbnkbg.com	epstbnkbg.com
6	1

This site contains no links.

Subject Issuer	Validity	Valid
epstbnkbg.com R11	`2024-11-16` - `2025-02-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://epstbnkbg.com/bg/?master=mind
Frame ID: 50854B6264AC3A1CC5BF3E90820FC102
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Postbank

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

614 kB
Transfer

643 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response epstbnkbg.com/bg/	2 KB 802 B	1329ms 748ms	Document text/html	185.80.129.168 VPSNET-AS UAB ESNET
General Check archive.org Show headers Download Go to Full URL https://epstbnkbg.com/bg/?master=mind Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.80.129.168 , Lithuania, ASN61053 (VPSNET-AS UAB ESNET, LT), Reverse DNS Software nginx / Resource Hash `204bde7c23012d4115f6824f87949b336cc9edac8d9a33d17dce5f2eda861c68` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers content-encoding gzip content-length 692 content-type text/html; charset=UTF-8 date Mon, 18 Nov 2024 06:32:34 GMT server nginx vary Accept-Encoding
GET H2	200	style.css epstbnkbg.com/bg/rcss/	5 KB 1 KB	284ms 283ms	Stylesheet text/css	185.80.129.168 VPSNET-AS UAB ESNET
General Check archive.org Show headers Download Go to Full URL https://epstbnkbg.com/bg/rcss/style.css Requested by Host: epstbnkbg.com URL: https://epstbnkbg.com/bg/?master=mind Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.80.129.168 , Lithuania, ASN61053 (VPSNET-AS UAB ESNET, LT), Reverse DNS Software nginx / Resource Hash `21210e5c26222a5cb0161434a1e3e02f2d88c6597eedc0797c25e5a6fa82727d` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Referer https://epstbnkbg.com/bg/?master=mind Response headers cache-control max-age=315360000 content-encoding gzip etag W/"64d9fcf8-1274" expires Thu, 31 Dec 2037 23:55:55 GMT date Mon, 18 Nov 2024 06:32:35 GMT content-type text/css last-modified Mon, 14 Aug 2023 10:07:52 GMT server nginx
GET H2	200	logo-pb-bg.svg epstbnkbg.com/bg/rfiles/	22 KB 8 KB	376ms 375ms	Image image/svg+xml	185.80.129.168 VPSNET-AS UAB ESNET
General Check archive.org Show headers Download Go to Show image Full URL https://epstbnkbg.com/bg/rfiles/logo-pb-bg.svg Requested by Host: epstbnkbg.com URL: https://epstbnkbg.com/bg/?master=mind Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.80.129.168 , Lithuania, ASN61053 (VPSNET-AS UAB ESNET, LT), Reverse DNS Software nginx / Resource Hash `d43f1065c1da157c7e75c4b8782dc807172fc5db05ddb5b82947322b7f7e602f` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Referer https://epstbnkbg.com/bg/?master=mind Response headers cache-control max-age=315360000 content-encoding gzip etag W/"64d57f6e-562d" expires Thu, 31 Dec 2037 23:55:55 GMT date Mon, 18 Nov 2024 06:32:35 GMT content-type image/svg+xml last-modified Fri, 11 Aug 2023 00:23:10 GMT server nginx
GET H2	200	logo-epb-bg.svg epstbnkbg.com/bg/rfiles/	19 KB 8 KB	604ms 604ms	Image image/svg+xml	185.80.129.168 VPSNET-AS UAB ESNET
General Check archive.org Show headers Download Go to Show image Full URL https://epstbnkbg.com/bg/rfiles/logo-epb-bg.svg Requested by Host: epstbnkbg.com URL: https://epstbnkbg.com/bg/?master=mind Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.80.129.168 , Lithuania, ASN61053 (VPSNET-AS UAB ESNET, LT), Reverse DNS Software nginx / Resource Hash `dfed15c322e4ed286342087ef2244f30be43721b8f29fd9ce8a4a3bc14969a0d` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Referer https://epstbnkbg.com/bg/?master=mind Response headers cache-control max-age=315360000 content-encoding gzip etag W/"64d57f7e-4d9d" expires Thu, 31 Dec 2037 23:55:55 GMT date Mon, 18 Nov 2024 06:32:35 GMT content-type image/svg+xml last-modified Fri, 11 Aug 2023 00:23:26 GMT server nginx
GET H2	200	PB.jpg epstbnkbg.com/bg/rfiles/	595 KB 596 KB	329ms 329ms	Image image/jpeg	185.80.129.168 VPSNET-AS UAB ESNET
General Check archive.org Show headers Download Go to Show image Full URL https://epstbnkbg.com/bg/rfiles/PB.jpg Requested by Host: epstbnkbg.com URL: https://epstbnkbg.com/bg/rcss/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.80.129.168 , Lithuania, ASN61053 (VPSNET-AS UAB ESNET, LT), Reverse DNS Software nginx / Resource Hash `55b062bfb218e32a277af5edf7448280dc8805739e1f77ee0d3e79fb63ea343c` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Referer https://epstbnkbg.com/bg/rcss/style.css Response headers cache-control max-age=315360000 etag "6738a415-94b32" expires Thu, 31 Dec 2037 23:55:55 GMT accept-ranges bytes content-length 609074 date Mon, 18 Nov 2024 06:32:35 GMT content-type image/jpeg last-modified Sat, 16 Nov 2024 13:54:29 GMT server nginx
GET H2	200	favicon.png epstbnkbg.com/bg/rfiles/	738 B 913 B	288ms 287ms	Other image/png	185.80.129.168 VPSNET-AS UAB ESNET
General Check archive.org Show headers Download Go to Full URL https://epstbnkbg.com/bg/rfiles/favicon.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.80.129.168 , Lithuania, ASN61053 (VPSNET-AS UAB ESNET, LT), Reverse DNS Software nginx / Resource Hash `7f7f9b8e12bf10627302ab6c6a443668c8b740367bf9ad9d0285493fdade1f0a` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Referer https://epstbnkbg.com/bg/?master=mind Response headers cache-control max-age=315360000 etag "64d58268-2e2" expires Thu, 31 Dec 2037 23:55:55 GMT accept-ranges bytes content-length 738 date Mon, 18 Nov 2024 06:32:36 GMT content-type image/png last-modified Fri, 11 Aug 2023 00:35:52 GMT server nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: E Postbank (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://epstbnkbg.com/bg/?master=mind Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

epstbnkbg.com
185.80.129.168
204bde7c23012d4115f6824f87949b336cc9edac8d9a33d17dce5f2eda861c68
21210e5c26222a5cb0161434a1e3e02f2d88c6597eedc0797c25e5a6fa82727d
55b062bfb218e32a277af5edf7448280dc8805739e1f77ee0d3e79fb63ea343c
7f7f9b8e12bf10627302ab6c6a443668c8b740367bf9ad9d0285493fdade1f0a
d43f1065c1da157c7e75c4b8782dc807172fc5db05ddb5b82947322b7f7e602f
dfed15c322e4ed286342087ef2244f30be43721b8f29fd9ce8a4a3bc14969a0d

epstbnkbg.com Open in urlscan Pro 185.80.129.168 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

614 kBTransfer

643 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

epstbnkbg.com Open in urlscan Pro
185.80.129.168 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

614 kB
Transfer

643 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!