royalclientsecure.com Open in urlscan Pro
176.119.2.148 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://royalclientsecure.com/auth/RoyalRBC?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
Effective URL:
https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
Submission: On October 29 via api (October 29th 2021, 4:03:34 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 16 HTTP transactions. The main IP is 176.119.2.148, located in Ukraine and belongs to GLP-AS, UA. The main domain is royalclientsecure.com.
TLS certificate: Issued by R3 on October 15th 2021. Valid for: 3 months.

This is the only time royalclientsecure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: RBC (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 17	176.119.2.148 176.119.2.148		58271 (GLP-AS) (GLP-AS)
16	1

17 176.119.2.148 (Ukraine) 1 redirects

ASN58271 (GLP-AS, UA)

royalclientsecure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	royalclientsecure.com 1 redirects royalclientsecure.com	85 KB
16	1

	Domain	Requested by
17	royalclientsecure.com	1 redirects royalclientsecure.com
16	1

This site contains no links.

Subject Issuer	Validity	Valid
royalclientsecure.com R3	`2021-10-15` - `2022-01-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
Frame ID: F095DF1AB24DC17FBD88FD959AF2AF8F
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RBC Royal Bank - Sign In to Online Banking

Page URL History Show full URLs

https://royalclientsecure.com/auth/RoyalRBC?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71... HTTP 301
https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e7... Page URL

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

84 kB
Transfer

80 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://royalclientsecure.com/auth/RoyalRBC?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec HTTP 301
https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
royalclientsecure.com/auth/RoyalRBC/
Redirect Chain

https://royalclientsecure.com/auth/RoyalRBC?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

26 KB
26 KB

286ms
152ms

Document
text/html

176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) / PHP/5.3.3

Resource Hash

b090cc889ca7b79d887990d4ede8e0499881060dc87f4d2b4d8511ca99067b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 29 Oct 2021 16:03:29 GMT
Server: Apache/2.2.22 (@RELEASE@)
Strict-Transport-Security: max-age=31536000; preload
X-Powered-By: PHP/5.3.3
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

Redirect headers

Date: Fri, 29 Oct 2021 16:03:29 GMT
Server: Apache/2.2.22 (@RELEASE@)
Strict-Transport-Security: max-age=31536000; preload
Location: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
Content-Length: 431
Connection: close
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK main.css
royalclientsecure.com/auth/RoyalRBC/ 31 KB
31 KB 204ms
67ms Stylesheet
text/css 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://royalclientsecure.com/auth/RoyalRBC/main.css

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

7ddb3f4623a9d0aea62cbfb45bd4aab80bb3f0f810da35877f00241343520e44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3f-7c58-5ce674ad3943c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 31832

GET
H/1.1 200
OK logo_rbc-royalbank-white-en.svg
royalclientsecure.com/auth/RoyalRBC/ 5 KB
6 KB 205ms
68ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/logo_rbc-royalbank-white-en.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

4ad25cca003756c56d16dbc0b68bc7bf4449a33aeb046eb4d0552990a2cfdb9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c35-1562-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 5474

GET
H/1.1 200
OK search-signin.svg
royalclientsecure.com/auth/RoyalRBC/ 508 B
824 B 221ms
73ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/search-signin.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

6a4cefca46eb1ca796a81fd90f6c8a5c5dc4a8526bde1a9634a833b47221bb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3d-1fc-5ce674ad39054"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 508

GET
H/1.1 200
OK canada.svg
royalclientsecure.com/auth/RoyalRBC/ 836 B
1 KB 222ms
74ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/canada.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

78920a7468b87496f5d9d3e5ec2bae5ba070c741c6d71eb1e7b3214a92bb353c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c39-344-5ce674ad38c6c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 836

GET
H/1.1 200
OK logo-rbc-shield.svg
royalclientsecure.com/auth/RoyalRBC/ 5 KB
5 KB 222ms
74ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/logo-rbc-shield.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

65810b2abb5357e9d521f65bc4270894f90cb4f531b9d48bd202e3562920bfde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c0e-143d-5ce674ad374fb"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 5181

GET
H/1.1 200
OK close-blue.svg
royalclientsecure.com/auth/RoyalRBC/ 440 B
756 B 222ms
73ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/close-blue.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

f072f948a69fa01073e7561ffc54019409436fff0deee7c868ca670b2f4b849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c1e-1b8-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 440

GET
H/1.1 200
OK tooltipPeak.png
royalclientsecure.com/auth/RoyalRBC/ 259 B
571 B 197ms
66ms Image
image/png 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/tooltipPeak.png

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

5ebd4e99e10ea98455582e5949a0d1bda24645b23971cd3e322eeea55f9b1c48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c34-103-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 259

GET
H/1.1 200
OK to-top-white.svg
royalclientsecure.com/auth/RoyalRBC/ 443 B
759 B 302ms
75ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/to-top-white.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

a51aaa34a0ed0bbfa7cd4cbfb5060f0c0a277825702f9f87ec921bb1deb0022d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/?818110a198b17c6080e56f6a14969b9b=&dispatch=feb87db90e1b7080e71a1ba41dc53d5bcd7486ec
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c37-1bb-5ce674ad38c6c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 443

GET
H/1.1 200
OK triangle-down-white.svg
royalclientsecure.com/auth/RoyalRBC/ 398 B
714 B 341ms
79ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/triangle-down-white.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

657af7581552bd71f795ce717ae163c62507c7fc12dfefae0cf4ed4811f3f2eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c33-18e-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 398

GET
H/1.1 200
OK chevron-right-white.svg
royalclientsecure.com/auth/RoyalRBC/ 427 B
743 B 382ms
77ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/chevron-right-white.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

1c323c6269a284f42a11ab70483a7ef20003570cde175735da4b1e2b0d12b5a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c16-1ab-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 427

GET
H/1.1 200
OK angle-right-small.svg
royalclientsecure.com/auth/RoyalRBC/ 2 KB
2 KB 424ms
70ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/angle-right-small.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

169b2c80c3cf9bba841ccd21f0a32cd56cf82b55917b228f0d9354fa5e312479

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3a-89e-5ce674ad38c6c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2206

GET
H/1.1 200
OK lock-small.svg
royalclientsecure.com/auth/RoyalRBC/ 2 KB
2 KB 426ms
72ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/lock-small.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

208bd303e33d60639dbebdf5a93db4f0fb2999bda5c34bb8408679bbb8243197

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c18-752-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 1874

GET
H/1.1 200
OK chevron.png
royalclientsecure.com/auth/RoyalRBC/ 149 B
460 B 111ms
75ms Image
image/png 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/chevron.png

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

463c807898d95421f1d1b08aa1cf30873aa2cfeec128f65946107a2d27700f5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c12-95-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 149

GET
H/1.1 200
OK external-link-small.svg
royalclientsecure.com/auth/RoyalRBC/ 2 KB
3 KB 172ms
69ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/external-link-small.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

776c50dabbcf9967aef068d7ffa38e199a2b9a7e87697750a22ea70344072f32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3c-9b1-5ce674ad39054"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2481

GET
H/1.1 200
OK external-link-small-blue.svg
royalclientsecure.com/auth/RoyalRBC/ 2 KB
3 KB 380ms
282ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://royalclientsecure.com/auth/RoyalRBC/external-link-small-blue.svg

Requested by

Host: royalclientsecure.com
URL: https://royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

8573659e2191285fd760e060f497bcb52a87936f8806251471dbefae13795ca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:03:30 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c32-98e-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2446

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: RBC (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

royalclientsecure.com
176.119.2.148
169b2c80c3cf9bba841ccd21f0a32cd56cf82b55917b228f0d9354fa5e312479
1c323c6269a284f42a11ab70483a7ef20003570cde175735da4b1e2b0d12b5a7
208bd303e33d60639dbebdf5a93db4f0fb2999bda5c34bb8408679bbb8243197
463c807898d95421f1d1b08aa1cf30873aa2cfeec128f65946107a2d27700f5b
4ad25cca003756c56d16dbc0b68bc7bf4449a33aeb046eb4d0552990a2cfdb9a
5ebd4e99e10ea98455582e5949a0d1bda24645b23971cd3e322eeea55f9b1c48
657af7581552bd71f795ce717ae163c62507c7fc12dfefae0cf4ed4811f3f2eb
65810b2abb5357e9d521f65bc4270894f90cb4f531b9d48bd202e3562920bfde
6a4cefca46eb1ca796a81fd90f6c8a5c5dc4a8526bde1a9634a833b47221bb3c
776c50dabbcf9967aef068d7ffa38e199a2b9a7e87697750a22ea70344072f32
78920a7468b87496f5d9d3e5ec2bae5ba070c741c6d71eb1e7b3214a92bb353c
7ddb3f4623a9d0aea62cbfb45bd4aab80bb3f0f810da35877f00241343520e44
8573659e2191285fd760e060f497bcb52a87936f8806251471dbefae13795ca0
a51aaa34a0ed0bbfa7cd4cbfb5060f0c0a277825702f9f87ec921bb1deb0022d
b090cc889ca7b79d887990d4ede8e0499881060dc87f4d2b4d8511ca99067b4b
f072f948a69fa01073e7561ffc54019409436fff0deee7c868ca670b2f4b849b

royalclientsecure.com Open in urlscan Pro 176.119.2.148 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

84 kBTransfer

80 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

royalclientsecure.com Open in urlscan Pro
176.119.2.148 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

84 kB
Transfer

80 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!