urlscan.io logo urlscan.io
SecurityTrails logo

mailsafe.bankoguam.com Open in urlscan Pro
69.20.94.77  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://mailsafe.bankoguam.com/
Submission: On December 04 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 69.20.94.77, located in San Antonio, United States and belongs to RACKSPACE - Rackspace Hosting, US. The main domain is mailsafe.bankoguam.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 4th 2019. Valid for: 3 months.
This is the only time mailsafe.bankoguam.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 69.20.94.77 27357 (RACKSPACE)
4 165.212.54.52 14454 (PERIMETER...)
5 2
Apex Domain
Subdomains		 Transfer
4 bankofguam.com
mailsafe.bankofguam.com
378 KB
1 bankoguam.com
mailsafe.bankoguam.com
2 KB
5 2
Domain Requested by
4 mailsafe.bankofguam.com mailsafe.bankoguam.com
1 mailsafe.bankoguam.com
5 2

This site contains links to these domains. Also see Links.

Domain
bankofguam.com
mailsafe.bankofguam.com
www.bankofguam.com
Subject Issuer Validity Valid
bankoguam.com
Let's Encrypt Authority X3		 2019-12-04 -
2020-03-03		 3 months crt.sh
mailsafe.bankofguam.com
Thawte EV RSA CA 2018		 2018-02-16 -
2020-02-16		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://mailsafe.bankoguam.com/
Frame ID: 639999B9765E59F8A24FAF9BF1768011
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Debian/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

380 kB
Transfer

380 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
mailsafe.bankoguam.com/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mailsafe.bankoguam.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.20.94.77 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Apache/2.4.25 (Debian) /
Resource Hash
5a227f3a4016a0e83842c80a25fe4fa1c5ca8cb7d400cc8d1b866b86c4790403

Request headers

Host
mailsafe.bankoguam.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1

Response headers

Date
Wed, 04 Dec 2019 20:29:58 GMT
Server
Apache/2.4.25 (Debian)
Last-Modified
Wed, 04 Dec 2019 20:29:37 GMT
ETag
"ba2-598e6abedabc9-gzip"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1258
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
main.min.css
mailsafe.bankofguam.com/content/C8.MAIN.4.26B/css/ 		279 KB
279 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://mailsafe.bankofguam.com/content/C8.MAIN.4.26B/css/main.min.css
Requested by
Host: mailsafe.bankoguam.com
URL: https://mailsafe.bankoguam.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
165.212.54.52 , United States, ASN14454 (PERIMETER-ESECURITY - BAE Systems Applied Intelligence US Corp., US),
Reverse DNS
millyardbank.mailsafe.usa.net
Software
Apache /
Resource Hash
66f08ab2f619fc9bde59ee2f9cf9ff368728618d13335eade73411da05cd6cd2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://mailsafe.bankoguam.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 04 Dec 2019 20:29:58 GMT
Last-Modified
Tue, 05 Nov 2019 15:19:04 GMT
Server
Apache
ETag
"45ce9-5969af3dc8a00"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Connection
close
Accept-Ranges
bytes
Content-Length
285929
commoncombined.js
mailsafe.bankofguam.com/content/C8.MAIN.4.26B/js/ 		52 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mailsafe.bankofguam.com/content/C8.MAIN.4.26B/js/commoncombined.js
Requested by
Host: mailsafe.bankoguam.com
URL: https://mailsafe.bankoguam.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
165.212.54.52 , United States, ASN14454 (PERIMETER-ESECURITY - BAE Systems Applied Intelligence US Corp., US),
Reverse DNS
millyardbank.mailsafe.usa.net
Software
Apache /
Resource Hash
e3b8a436585d41f5bedae298c15c52004847cf59b2262601c8c0341ceccf7519
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://mailsafe.bankoguam.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 04 Dec 2019 20:29:58 GMT
Last-Modified
Tue, 05 Nov 2019 15:19:10 GMT
Server
Apache
ETag
"d035-5969af4381780"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
53301
detect_timezone.js
mailsafe.bankofguam.com/content/C8.MAIN.4.26B/js/ 		15 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mailsafe.bankofguam.com/content/C8.MAIN.4.26B/js/detect_timezone.js
Requested by
Host: mailsafe.bankoguam.com
URL: https://mailsafe.bankoguam.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
165.212.54.52 , United States, ASN14454 (PERIMETER-ESECURITY - BAE Systems Applied Intelligence US Corp., US),
Reverse DNS
millyardbank.mailsafe.usa.net
Software
Apache /
Resource Hash
db2624e55a11a1024f9faf673f31e24be74bb1ac3bf8836d1e7f8baa80c80faa
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://mailsafe.bankoguam.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 04 Dec 2019 20:29:58 GMT
Last-Modified
Tue, 05 Nov 2019 15:19:06 GMT
Server
Apache
ETag
"3b8c-5969af3fb0e80"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
15244
logoleft.jpg
mailsafe.bankofguam.com/logos/mailsafe.bankofguam.com/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mailsafe.bankofguam.com/logos/mailsafe.bankofguam.com/logoleft.jpg
Requested by
Host: mailsafe.bankoguam.com
URL: https://mailsafe.bankoguam.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
165.212.54.52 , United States, ASN14454 (PERIMETER-ESECURITY - BAE Systems Applied Intelligence US Corp., US),
Reverse DNS
millyardbank.mailsafe.usa.net
Software
Apache /
Resource Hash
b8715e5f9e9c4cb69091e2e568ce3487cd86841953944c085e80991d6fe8ff9e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://mailsafe.bankoguam.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 04 Dec 2019 20:29:58 GMT
Last-Modified
Tue, 12 Mar 2019 17:09:05 GMT
Server
Apache
ETag
"7c82-583e8bf1bbe2b"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
31874

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

105 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate boolean| supportDoubleClick function| StringBuffer function| createRequestObject function| OpenWindow boolean| selectmsgs function| ResetCheckAll function| CheckItem function| CheckListItems number| maxWidth number| maxHeight object| images number| numImgs function| setImagesSizes function| setSize function| checkImageSizes function| timedsetSize function| imageLoaded function| addImage function| printPages function| printPages2 object| C function| printTable3 function| isWhiteSpace function| ltrim function| rtrim function| stripChar function| isEmpty function| getObj function| isNum function| trimSpaces function| isEmail string| invalidAddrChars string| invalidDomainChars function| isEmailChars function| ReplaceChar function| ValidateDate function| formatDate function| stringReplace function| xDigitsErr function| formattedStrErr function| stateSelectionErr function| selectionErr function| dateErr function| LeapYear function| DayExists function| SendMail boolean| openingwindow function| NewItemWindow function| disableSelection number| startselect boolean| checkboxselected boolean| shiftpressed boolean| ctrlpressed number| rowcnt boolean| haspreviewpane boolean| singleselectlist number| previewdelaytime boolean| reloadInProgress boolean| ignoreKeyPress function| setKeyUp number| rowheight function| setKeyPress boolean| reloadedListItems function| getListItemsInternal function| getListItems function| clickRow function| selectRow function| moveSelected function| updateRowClass function| addHoverEffect function| checkForReturn string| menutype function| openRightMenu function| hideMenu function| stripWindowInvalidChars function| clearPreviewPane function| checkClearPreviewPane function| previewCount function| setTablebodyHeightIE6 function| openDropdownMenu function| hideDropdownMenu function| initOverLabels function| hideLabel function| printWindowName function| getScreenWidth object| F number| FC function| updateFolderCounts undefined| logoutTimer undefined| timeoutWarningTimer object| timeoutNoticeObj function| displayTimeoutWarning function| okSession function| evalfunc function| extendSession function| setFocusFirstField function| debounce function| DHTML_modalMessage object| windowsizes object| dropdownmenus number| menucount object| jzTimezoneDetector function| checktz

0 Cookies