printcustom.co.id
Open in
urlscan Pro
162.241.152.105
Malicious Activity!
Public Scan
Effective URL: https://printcustom.co.id/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvN...
Submission: On August 10 via manual from FR — Scanned from FR
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 14th 2021. Valid for: a year.
This is the only time printcustom.co.id was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banque Postale (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 107.155.89.162 107.155.89.162 | 29802 (HVC-AS) (HVC-AS) | |
2 4 | 162.241.152.105 162.241.152.105 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
3 | 3 |
ASN29802 (HVC-AS, US)
PTR: server.dedicadomvf4.com
socicon.com.br |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: adconomic.com
printcustom.co.id |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
printcustom.co.id
2 redirects
printcustom.co.id |
724 KB |
2 |
socicon.com.br
1 redirects
socicon.com.br |
648 B |
3 | 2 |
Domain | Requested by | |
---|---|---|
4 | printcustom.co.id |
2 redirects
printcustom.co.id
|
2 | socicon.com.br | 1 redirects |
3 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
socicon.com.br cPanel, Inc. Certification Authority |
2022-07-08 - 2022-10-06 |
3 months | crt.sh |
printcustom.co.id Sectigo RSA Domain Validation Secure Server CA |
2021-10-14 - 2022-10-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://printcustom.co.id/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNC4wLjUxMTIuNzkgU2FmYXJpLzUzNy4zNjkyLjIyMi4yMTIuMTcyMDIyOkF1ZzpXZWQ=
Frame ID: 5830271676D0DA0D3C4B25B72F632B49
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Espace client - La Banque PostalePage URL History Show full URLs
-
https://socicon.com.br/wi
HTTP 301
https://socicon.com.br/wi/ Page URL
-
https://printcustom.co.id/pos
HTTP 301
https://printcustom.co.id/pos/ HTTP 302
https://printcustom.co.id/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2N... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://socicon.com.br/wi
HTTP 301
https://socicon.com.br/wi/ Page URL
-
https://printcustom.co.id/pos
HTTP 301
https://printcustom.co.id/pos/ HTTP 302
https://printcustom.co.id/pos/pstl-log.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNC4wLjUxMTIuNzkgU2FmYXJpLzUzNy4zNjkyLjIyMi4yMTIuMTcyMDIyOkF1ZzpXZWQ= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://socicon.com.br/wi HTTP 301
- https://socicon.com.br/wi/
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
socicon.com.br/wi/ Redirect Chain
|
160 B 401 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
pstl-log.php
printcustom.co.id/pos/ Redirect Chain
|
1 MB 693 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
302 KB 302 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
302 KB 302 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
336 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
printcustom.co.id/pos/Pstl_files/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banque Postale (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
printcustom.co.id
socicon.com.br
107.155.89.162
162.241.152.105
0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e
1a5627a97aa8d55f0866a282ca1d226bf320f6f4aed2aeb76936f84460760318
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
59cfcb71c103829c51988f9ba4640a8ba7e3f02c823b9e6440805d0f3255dbcf
5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
6153992e4fe15daa0a730f0295eb2cebfe6f97d671fcbc7b4aae635d8f17a63a
6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a
a079710e67a906296308d3f4e23f6e8a1bfb326e926af1cf4feeec723c8d4674
bc7f0e13f4b934d89203e33eeadea30894ad68281a2e7ed87a79c947ba51b35b