urlscan.io logo urlscan.io
SecurityTrails logo

postbank-schutzen-ip.com Open in urlscan Pro
2606:4700:3034::ac43:9571  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://postbank-schutzen-ip.com/
Effective URL: https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
Submission: On March 13 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3034::ac43:9571, located in United States and belongs to CLOUDFLARENET, US. The main domain is postbank-schutzen-ip.com.
TLS certificate: Issued by GTS CA 1P5 on March 7th 2024. Valid for: 3 months.
This is the only time postbank-schutzen-ip.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
3 10 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
9 4
Apex Domain
Subdomains		 Transfer
10 postbank-schutzen-ip.com
postbank-schutzen-ip.com
592 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228
28 KB
9 3
Domain Requested by
10 postbank-schutzen-ip.com 3 redirects cdnjs.cloudflare.com
postbank-schutzen-ip.com
1 cdn.jsdelivr.net postbank-schutzen-ip.com
1 cdnjs.cloudflare.com postbank-schutzen-ip.com
9 3

This site contains no links.

Subject Issuer Validity Valid
postbank-schutzen-ip.com
GTS CA 1P5		 2024-03-07 -
2024-06-05		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh

This page contains 2 frames:

Primary Page: https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
Frame ID: 590BF6D6E8537893A88C88C208CF77BF
Requests: 13 HTTP requests in this frame

Frame: https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/5b600c458061/main.js
Frame ID: 086CC05431648B10CA38D705A2FAFF0B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Postbank Banking & Brokeragepb-logo

Page URL History Show full URLs

  1. https://postbank-schutzen-ip.com/ Page URL
  2. https://postbank-schutzen-ip.com/c9f7198c57735fa7a7a8ac2cc18dd542.php HTTP 302
    https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/index.php HTTP 302
    https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

9
Requests

89 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

669 kB
Transfer

2023 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://postbank-schutzen-ip.com/ Page URL
  2. https://postbank-schutzen-ip.com/c9f7198c57735fa7a7a8ac2cc18dd542.php HTTP 302
    https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/index.php HTTP 302
    https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/5b600c458061/main.js

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
postbank-schutzen-ip.com/ 		30 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d6e6eb3947f796e6147d182c537fa8068d3e7565bd2bd6642e033f9ae4cbe36

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
863b846e2aed18f1-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 13 Mar 2024 10:59:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XtbuTxEnxuAD1e4ZcfFE%2FFAfPVdFgPAsrOieiHOjtoOL4QwcJ2zh75BVtreWwZ2GCchZaz5WkRywBkxv9nduSmt3j99Bw4DKg3%2B3hP8LaC3MRuzebpdDREJKGHWTcrosFRimoJ0EuR7DzDWyhTWaCQaJnCdQn7E%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js
Requested by
Host: postbank-schutzen-ip.com
URL: https://postbank-schutzen-ip.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://postbank-schutzen-ip.com/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Wed, 13 Mar 2024 10:59:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
483793
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27964
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15d95"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7kI%2FJcpEDeuoFn6MlWSRFBMMuSPc%2F2usdjzJS2XPLCXpfLoGGPVbpjCh5gLrDWrYOswrPgICSZe3bj0uuVljFIY3495ebi759ccQH4XZNqSFZ1h7cAPGs1FXACukLoKKJW4BbB3UImCfBjjVG8GRa1g%2F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
863b846f6d7539be-FRA
expires
Mon, 03 Mar 2025 10:59:55 GMT
main.min.js
cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js
Requested by
Host: postbank-schutzen-ip.com
URL: https://postbank-schutzen-ip.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://postbank-schutzen-ip.com/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers
main.js
postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/5b600c458061/ Frame 086C
Redirect Chain
  • https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/5b600c458061/main.js
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/5b600c458061/main.js
Protocol
H2
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Wed, 13 Mar 2024 10:59:55 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bkG28xMC9Jdu3V5i2H0w99IZwU52rKfr6%2BX9BDnhqPq61Dgv0cjYqC2D3d%2FzW3pfnmFuEAC9htK%2Bdz0A%2FPwJxr%2F2S0kFSzT4t2lorJKhYDm3UATTdvWGrliOrWs7ChqkMlcs9PuDFXJsfO1eAOUudB7LneZd%2F5Y%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
863b846ffd6718f1-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Wed, 13 Mar 2024 10:59:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Te9cjGI27xP0Eskd3oghwt3to7xPI%2F075dFDM0KmSAI%2B6z9j4dKsk%2Bgj1BlAPPHinBs1hM7okrUFuDk%2FlxLKQhEO7dgQWgasdbPhqckF1UUiIPnBrVIQO%2Bi97Rg5lPs7idt6D7B8iHEO%2FRJqVPBnwQ4x8VkRVYE%3D"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/5b600c458061/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
863b846fdd3d18f1-FRA
alt-svc
h3=":443"; ma=86400
fetch.php
postbank-schutzen-ip.com/remote/ 		0
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/remote/fetch.php
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Referer
https://postbank-schutzen-ip.com/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Wed, 13 Mar 2024 10:59:55 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZJ%2BAtBJ9vLrR4jCEsD1B%2FIIsAmutCI%2Fl35m7DKdDgFGfh8fQG0bsUGNrFZ39%2BdB2nMy9MiA%2FL6qXtxYpdBwSbgVk5e5hL%2B9RNHH8dFH4t5ks42D%2Bk6IdeHcTf2vCWUPb6YgMwec9DFqTw40IWYxi0hk37BIvbE8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
863b846fdd4118f1-FRA
alt-svc
h3=":443"; ma=86400
Primary Request lgn.php
postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/
Redirect Chain
  • https://postbank-schutzen-ip.com/c9f7198c57735fa7a7a8ac2cc18dd542.php
  • https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/index.php
  • https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
799 KB
199 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
Requested by
Host: postbank-schutzen-ip.com
URL: https://postbank-schutzen-ip.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc9e98b78991b75488d1f3c34bf37ac4b39cf8110b4f3681ef9fb15508670109

Request headers

Referer
https://postbank-schutzen-ip.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
863b8471fff01d84-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 13 Mar 2024 10:59:55 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e7n8eUKTHB7s2yK%2FAIPqX7rzVR63im0CJRLLNvptiSlJbHJIviDcLOTICEYDVIqXGCIooiVJ2AnXwWCdjKyYXKFbY1O4gjGrWgBcWdbuYlWpqPySf5lJ7nUxwAUBX%2BXGmzkGPO3Y62DHT6Q1g8fzs36I0s%2FUEXQ%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
863b84709e231d84-FRA
content-type
text/html; charset=UTF-8
date
Wed, 13 Mar 2024 10:59:55 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
lgn.php?user=true
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=veUfSlpuMTWxoHO8dyxnD%2F7ITDXDeNlj7BMzkOq8nOhq7MHbi%2BXWTH2%2FGae024rukcjcrFx0BS4VSsb%2Bm4LG%2F66h3TmicmjISqfBl5agHPR7Ypo55%2FVJ%2BkLhpePvqYTZWo%2BV6FThKb160FYeIpL789BLuglk2fQ%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
863b846e2aed18f1
postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 086C 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/h/g/jsd/r/863b846e2aed18f1
Requested by
Host: postbank-schutzen-ip.com
URL: https://postbank-schutzen-ip.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 13 Mar 2024 10:59:55 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g8SJcwTmwKnyhWhw2y7lmWtI8%2Bv3o%2F8tNkBT7pEf0lrDCFEi1VtWTrD38FdrVOqph4Syj6b3mt7A%2BRYm2osUqF12n3I73sGXZ5%2BF0OoFy3q%2BJ6kk8PzfkLpAjpyFd306DHyW5eP6xCj8PaTrEzAVwCWJeDSzwIk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
863b8470fe891d84-FRA
alt-svc
h3=":443"; ma=86400
lgn.css
postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/partial/css/ 		490 KB
301 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/partial/css/lgn.css
Requested by
Host: postbank-schutzen-ip.com
URL: https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df09e9b0bd3299548f2dffd81e176a6127dd0fde2f3354ded32e0fcb01c5aef1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Wed, 13 Mar 2024 10:59:56 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 08 Mar 2024 21:45:05 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=crH9EptoWI866UqW%2BF3ERkoLoeMXhoxbdztQU1RyMxmVnM%2FaIYakUv%2Fhl2VT71rBdOQZ9W6lNJxtlyX7RxSTIazwpExz7JEMOSBW0PAZBk3CrmmFjTnGzi4G3Y6XAqpZ6ZjGDUGflkiMyQI%2F5l4pG5bRnFLWkuk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
863b8472a8d11d84-FRA
alt-svc
h3=":443"; ma=86400
jquery.js
postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/partial/js/ 		266 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/partial/js/jquery.js
Requested by
Host: postbank-schutzen-ip.com
URL: https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:9571 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Wed, 13 Mar 2024 10:59:56 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 08 Mar 2024 21:45:05 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=42U2mWqycEZUZtwUTv8o1DnST5HCNlMtDDaFC1TFQc%2Bq56NFsRZZ0VABvpLxuT95GdyLOS4rs25kDbJ3omGd7jtu%2B9kgWCvok5BIcAibv0UdT4WU9urKS8XI25S2M4gUfxA5QgY25JTAKzXzsTV4zN%2Fwa5Gu%2BUw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
cache-control
max-age=14400
cf-ray
863b8472a8d21d84-FRA
alt-svc
h3=":443"; ma=86400
truncated
/ 		42 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
40988765b5729bf021191fda5e3243ceb16158a6a3f388e81a4904fe94f8257c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		243 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
12164efcaf829ad24ff7a8367cdcd40dde1d4c23d437d28d791617a8827d7115

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ab65524380fa9267bbcf2d4df64def918baeeaf4df69a2d58026d2149b68d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de

Request headers

Referer
Origin
https://postbank-schutzen-ip.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31

Request headers

Referer
Origin
https://postbank-schutzen-ip.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
.postbank-schutzen-ip.com/ Name: cf_clearance
Value: T8IrDiMAX6qzEnn5e1sk6dchqJgd31D3vJHD.xFJvrE-1710327595-1.0.1.1-oYCsbMYpGQ2LGyA2gWlQHvlRm0YCnfxryJBQgomf_cLMRePUc7IAuDVrcznsjW2wkslIBfqpfif2XGS66eAKDA
postbank-schutzen-ip.com/ Name: PHPSESSID
Value: 34bfb1fe7d9c048ca9a2b81bf98372a0

2 Console Messages

Source Level URL
Text
network error URL: https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://postbank-schutzen-ip.com/fb93f4185aea5b548f0fe812e90678c4/lgn.php?user=true(Line 8)
Message:
X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.