www.bankofamerica-secure.dns2.us Open in urlscan Pro
185.238.1.71 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.bankofamerica-secure.dns2.us/
Effective URL:
https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present
Submission: On December 21 via automatic, source certstream-suspicious (December 21st 2021, 8:17:09 pm UTC) — Scanned from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 185.238.1.71, located in Seychelles and belongs to INTERNET-IT, SC. The main domain is www.bankofamerica-secure.dns2.us.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 21st 2021. Valid for: 3 months.

This is the only time www.bankofamerica-secure.dns2.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 10	185.238.1.71 185.238.1.71		200313 (INTERNET-IT) (INTERNET-IT)
9	1

10 185.238.1.71 (Seychelles) 1 redirects

ASN200313 (INTERNET-IT, SC)
PTR: johnsalvy63410.ptr1.ru

www.bankofamerica-secure.dns2.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	dns2.us 1 redirects www.bankofamerica-secure.dns2.us	685 KB
9	1

	Domain	Requested by
10	www.bankofamerica-secure.dns2.us	1 redirects www.bankofamerica-secure.dns2.us
9	1

This site contains no links.

Subject Issuer	Validity	Valid
bankofamerica-secure.dns2.us cPanel, Inc. Certification Authority	`2021-12-21` - `2022-03-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present
Frame ID: 4AC2BBF1B303BD50AC0D6AEF7BF3140B
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in Protection

Page URL History Show full URLs

https://www.bankofamerica-secure.dns2.us/ HTTP 302
https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Page URL

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

684 kB
Transfer

682 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.bankofamerica-secure.dns2.us/ HTTP 302
https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request loginweb Show response www.bankofamerica-secure.dns2.us/ Redirect Chain https://www.bankofamerica-secure.dns2.us/ https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present	2 KB 3 KB	146ms 146ms	Document text/html	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `e4a030112128f34d475724a13d1d591e57afe85d608f19166f988b5dec093155` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language en-US,en;q=0.9 Response headers Date Tue, 21 Dec 2021 20:17:03 GMT Server Apache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 21 Dec 2021 20:17:03 GMT Server Apache Location loginweb?sign-in/auth/login/present Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bactouch.css www.bankofamerica-secure.dns2.us/assets/css/	156 KB 156 KB	135ms 135ms	Stylesheet text/css	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/assets/css/bactouch.css Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `fba39b3e256e732b89d19ea76cfcc10fc3f610ae91b75abe4998eb79f302516e` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:03 GMT Last-Modified Thu, 14 Nov 2019 00:56:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 159511
GET H/1.1	200 OK	slidemenu.css www.bankofamerica-secure.dns2.us/assets/css/	13 KB 13 KB	140ms 138ms	Stylesheet text/css	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/assets/css/slidemenu.css Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `d0bbe7b0493ccd3f6adcd423951c73547cb2b04c086c47859bcf0bacc0c36a1f` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:03 GMT Last-Modified Wed, 13 Nov 2019 23:57:14 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 13324
GET H/1.1	200 OK	footer1.css www.bankofamerica-secure.dns2.us/assets/css/	1 KB 1 KB	275ms 128ms	Stylesheet text/css	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/assets/css/footer1.css Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `8022a229efd78b8f1b1633237f4dd1cd004dd5a3735a122331c69ded849965e8` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:04 GMT Last-Modified Thu, 14 Nov 2019 00:11:14 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1247
GET H/1.1	200 OK	toolbar1.css www.bankofamerica-secure.dns2.us/assets/css/	6 KB 6 KB	352ms 131ms	Stylesheet text/css	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/assets/css/toolbar1.css Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `d5422057b696f8ed67e05423bf45ee1038683b3b1e962a7185b8ea2665d894f9` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:04 GMT Last-Modified Thu, 14 Nov 2019 00:48:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 6263
GET H/1.1	200 OK	style1.css www.bankofamerica-secure.dns2.us/assets/css/	450 B 691 B	347ms 126ms	Stylesheet text/css	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/assets/css/style1.css Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `6aa83c0a00c619ed88c572d54d2b74f2db83594166822ff09866a1f005ebda52` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:04 GMT Last-Modified Mon, 17 Aug 2020 18:13:40 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 450
GET H/1.1	200 OK	blue-ui.css www.bankofamerica-secure.dns2.us/assets/css/	496 KB 496 KB	356ms 129ms	Stylesheet text/css	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://www.bankofamerica-secure.dns2.us/assets/css/blue-ui.css Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `af8850e29c883086b98e59ddede00e9af6922af5d63441790725eb3d644f3184` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:04 GMT Last-Modified Thu, 02 Jul 2020 08:52:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 507756
GET H/1.1	200 OK	logo.png www.bankofamerica-secure.dns2.us/assets/images/	3 KB 3 KB	210ms 124ms	Image image/png	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Show image Full URL https://www.bankofamerica-secure.dns2.us/assets/images/logo.png Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `05413ab7951f8c9e4bc16c6d4feb0908432cdf76f8e4c3309c745038d69ecc1d` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/loginweb?sign-in/auth/login/present User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:04 GMT Last-Modified Thu, 14 Nov 2019 00:38:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2871
GET H/1.1	200 OK	header.png www.bankofamerica-secure.dns2.us/assets/images/	5 KB 5 KB	121ms 120ms	Image image/png	185.238.1.71 INTERNET-IT
General Check archive.org Show headers Download Go to Show image Full URL https://www.bankofamerica-secure.dns2.us/assets/images/header.png Requested by Host: www.bankofamerica-secure.dns2.us URL: https://www.bankofamerica-secure.dns2.us/assets/css/toolbar1.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.238.1.71 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS johnsalvy63410.ptr1.ru Software Apache / Resource Hash `b23046e43a658d66847d3fb771a26e1673ab267b77427eab293f537de496f7e2` Request headers Accept-Language en-US,en;q=0.9 Referer https://www.bankofamerica-secure.dns2.us/assets/css/toolbar1.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Tue, 21 Dec 2021 20:17:05 GMT Last-Modified Sun, 10 Nov 2019 19:36:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 4843

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.bankofamerica-secure.dns2.us
185.238.1.71
05413ab7951f8c9e4bc16c6d4feb0908432cdf76f8e4c3309c745038d69ecc1d
6aa83c0a00c619ed88c572d54d2b74f2db83594166822ff09866a1f005ebda52
8022a229efd78b8f1b1633237f4dd1cd004dd5a3735a122331c69ded849965e8
af8850e29c883086b98e59ddede00e9af6922af5d63441790725eb3d644f3184
b23046e43a658d66847d3fb771a26e1673ab267b77427eab293f537de496f7e2
d0bbe7b0493ccd3f6adcd423951c73547cb2b04c086c47859bcf0bacc0c36a1f
d5422057b696f8ed67e05423bf45ee1038683b3b1e962a7185b8ea2665d894f9
e4a030112128f34d475724a13d1d591e57afe85d608f19166f988b5dec093155
fba39b3e256e732b89d19ea76cfcc10fc3f610ae91b75abe4998eb79f302516e

www.bankofamerica-secure.dns2.us Open in urlscan Pro 185.238.1.71 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

684 kBTransfer

682 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.bankofamerica-secure.dns2.us Open in urlscan Pro
185.238.1.71 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

684 kB
Transfer

682 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!