www.atmwest.ca
Open in
urlscan Pro
54.163.218.122
Malicious Activity!
Public Scan
URL:
http://www.atmwest.ca/chebanca/login.php?TYPE=33554432&REALMOID=06-000ed271-b9bd-158d-9acc-5e0b0a01900d&GUID=&SMAUTHRE...
Submission: On May 13 via manual from US — Scanned from CA
Submission: On May 13 via manual from US — Scanned from CA
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 8 HTTP transactions.
The main IP is 54.163.218.122, located in
United States and
belongs to AMAZON-AES, US.
The main domain is www.atmwest.ca.
This is the only time www.atmwest.ca was scanned on urlscan.io!
This is the only time www.atmwest.ca was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: CheBanca! (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 54.163.218.122 54.163.218.122 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 8 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
atmwest.ca
www.atmwest.ca |
786 KB |
| 8 | 1 |
| Domain | Requested by | |
|---|---|---|
| 8 | www.atmwest.ca |
www.atmwest.ca
|
| 8 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.atmwest.ca/chebanca/login.php?TYPE=33554432&REALMOID=06-000ed271-b9bd-158d-9acc-5e0b0a01900d&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=%2BbZiYd9wBBc7i6DnY9BIgImCfsobrShqAq1w8gw8P9KWbC&TARGET=:%2F%2Fwww.chebanca.it%2Fportalserver%2Fhomebanking%2Fhome
Frame ID: 8B9526EAB8D7810EA7D0C5F0D6F5BA51
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Accesso ClientiDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
www.atmwest.ca/chebanca/ |
58 KB 58 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.6.0.min.js
www.atmwest.ca/chebanca/js/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.redirect.js
www.atmwest.ca/chebanca/js/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.js
www.atmwest.ca/chebanca/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.min.00a5674097155ccc.css
www.atmwest.ca/chebanca/css/ |
582 KB 582 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite.1625500646917.png
www.atmwest.ca/chebanca/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
GT-America-Medium.woff2
www.atmwest.ca/chebanca/fonts/ |
21 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
GT-America-Light.woff2
www.atmwest.ca/chebanca/fonts/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: CheBanca! (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.atmwest.ca
54.163.218.122
057ca9c9ec4d245c05c9343564e72ef3f2ad891b51d689694d967f039e9da024
0a0a5177a1f61c8560f35bcefe388f2180b3149f393a45dd20525961c5073849
2e7060618d5202818aeefd8a7848d7963989e18107d7bca279a62a09aba598fd
6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98
a34a39729013720447cb7b3cdcb8ebfb11829ae72e53ad3c9acfcde0c893ec56
ab4beb10a98c6594f9decdd9f590e60176a3de87bc2e62e9c7766ce90ee41606
ff1081a75878d5f41ad55e7e90c58fd090a2d70a2b42181643a0e5fbe98571d3
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e