mindtheshoe.gr Open in urlscan Pro
185.4.135.71 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://mindtheshoe.gr/cli/BOA/en/confirm_login.php
Submission: On June 20 via automatic, source openphish (June 20th 2017, 12:48:30 am UTC)

Summary HTTP 12 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 185.4.135.71, located in Greece and belongs to TOPHOST-SOUTH, GR. The main domain is mindtheshoe.gr.

This is the only time mindtheshoe.gr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Bank of America (Banking)

Domain & IP information

	IP Address		AS Autonomous System
10	185.4.135.71 185.4.135.71		60342 (TOPHOST-S...) (TOPHOST-SOUTH)
12	2

10 185.4.135.71 (Greece)

ASN60342 (TOPHOST-SOUTH, GR)
PTR: rlinux19.grserver.gr

mindtheshoe.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	mindtheshoe.gr mindtheshoe.gr	180 KB
12	1

	Domain	Requested by
10	mindtheshoe.gr	mindtheshoe.gr
12	1

This site contains links to these domains. Also see Links.

Domain
www.bankofamerica.com

Subject Issuer	Validity	Valid
mindtheshoe.gr Let's Encrypt Authority X3	`2017-06-17` - `2017-09-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php
Frame ID: 8691.1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

12
Requests

8 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

180 kB
Transfer

572 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bankofamerica.com/onlinebanking/learning-center.go
Title: Learn more about Online Banking

Search URL Search Domain Scan URL

URL: https://www.bankofamerica.com/online-banking/service-agreement.go
Title: Service Agreement

Search URL Search Domain Scan URL

URL: https://www.bankofamerica.com/privacy/
Title: Privacy & Security

Search URL Search Domain Scan URL

URL: http://www.bankofamerica.com/help/equalhousing_popup.cfm
Title: Equal Housing Lender

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request 5

http://mindtheshoe.gr/cli/BOA/en/imgs/summary-bground.jpg
https://mindtheshoe.gr/cli/BOA/en/imgs/summary-bground.jpg

Request 9

http://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.woff
https://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.woff

Request 10

http://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.ttf
https://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.ttf

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request confirm_login.php Show response mindtheshoe.gr/cli/BOA/en/	10 KB 8 KB	548ms 394ms	Document text/html	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Full URL http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PHP/5.6.30, PleskLin Resource Hash `cfb41f9d8ff8e769022aacb8807c940d67f124fcfa7f96dd479bf91d505bc46d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:16 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/5.6.30, PleskLin Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	soa.js Show response mindtheshoe.gr/cli/BOA/en/imgs/	20 KB 6 KB	73ms 73ms	Script text/javascript	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/soa.js Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/confirm_login.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT Content-Encoding gzip ETag W/"53c3f620-4f65" Last-Modified Mon, 14 Jul 2014 15:24:16 GMT Server nginx X-Powered-By PleskLin Vary Accept-Encoding Content-Type text/javascript Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	login.css mindtheshoe.gr/cli/BOA/en/imgs/	133 KB 21 KB	77ms 77ms	Stylesheet text/css	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/login.css Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `092f0fd4ebf0542f944fb3ff4d704bfc308daf374efd1bfe5d7f37e2ac62060c` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/confirm_login.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT Content-Encoding gzip ETag W/"54e5f2bc-2124d" Last-Modified Thu, 19 Feb 2015 14:27:08 GMT Server nginx X-Powered-By PleskLin Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	login.js Show response mindtheshoe.gr/cli/BOA/en/imgs/	355 KB 93 KB	145ms 79ms	Script text/javascript	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/login.js Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `07e4c753ffc2eb5b218c8f022406951f1c052771ffe9b22aecff0e705f4c13f8` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/confirm_login.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT Content-Encoding gzip ETag W/"54055f32-58a44" Last-Modified Tue, 02 Sep 2014 06:09:54 GMT Server nginx X-Powered-By PleskLin Vary Accept-Encoding Content-Type text/javascript Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	LOGO.gif mindtheshoe.gr/cli/BOA/en/imgs/	4 KB 4 KB	74ms 74ms	Image image/gif	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Show image Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/LOGO.gif Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/confirm_login.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT Last-Modified Tue, 23 Sep 2014 23:03:54 GMT Server nginx X-Powered-By PleskLin ETag "5421fc5a-e0c" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 3596
GET H/1.1	200 OK	secure.png mindtheshoe.gr/cli/BOA/en/imgs/	473 B 473 B	72ms 72ms	Image image/png	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Show image Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/secure.png Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/imgs/login.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT ETag "e3e99b-1d9-50206ae025100" Last-Modified Mon, 01 Sep 2014 20:16:36 GMT Server nginx X-Powered-By PleskLin Content-Type image/png X-Accel-Version 0.01 Connection keep-alive Accept-Ranges bytes Content-Length 473
GET H/1.1	404 Not Found	summary-bground.jpg mindtheshoe.gr/cli/BOA/en/imgs/ Redirect Chain http://mindtheshoe.gr/cli/BOA/en/imgs/summary-bground.jpg https://mindtheshoe.gr/cli/BOA/en/imgs/summary-bground.jpg	3 KB 0	387ms 184ms	Image text/html	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Show image Full URL https://mindtheshoe.gr/cli/BOA/en/imgs/summary-bground.jpg Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/confirm_login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PHP/5.6.30, PleskLin Resource Hash `258b22f458e2e21c3104876ab8fc1b311c116f0692fe04072d2340d19d6bacfb` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/imgs/login.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers X-Content-Powered-By K2 v2.7.1 (by JoomlaWorks) Date Tue, 20 Jun 2017 00:48:17 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/5.6.30, PleskLin Vary Accept-Encoding P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Pragma no-cache Cache-Control no-cache X-Logged-In False Connection keep-alive Content-Type text/html; charset=UTF-8 Content-Length 1024 Redirect headers Date Tue, 20 Jun 2017 00:48:17 GMT Content-Encoding gzip X-Powered-By PHP/5.6.30, PleskLin Pragma no-cache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" X-Logged-In False Connection keep-alive Content-Length 20 X-Content-Powered-By K2 v2.7.1 (by JoomlaWorks) Last-Modified Tue, 20 Jun 2017 00:48:17 GMT Server nginx Vary Accept-Encoding Content-Type text/html; charset=utf-8 Location https://mindtheshoe.gr/cli/BOA/en/imgs/summary-bground.jpg Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires Wed, 17 Aug 2005 00:00:00 GMT
GET H/1.1	200 OK	gfootb.png mindtheshoe.gr/cli/BOA/en/imgs/	48 KB 48 KB	136ms 74ms	Image image/png	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Show image Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/gfootb.png Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/imgs/login.js Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/imgs/login.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT Last-Modified Mon, 01 Sep 2014 20:12:18 GMT Server nginx X-Powered-By PleskLin ETag "5404d322-be1b" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 48667
GET H/1.1	200 OK	gfoot-home.png mindtheshoe.gr/cli/BOA/en/imgs/	144 B 144 B	132ms 70ms	Image image/png	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Show image Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/gfoot-home.png Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/imgs/login.js Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `a8bc6337547a246ef75d1ae66d7ec8a0ed6171c1ba49804a403124e27c8e8452` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/imgs/login.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT ETag "e3e927-90-502069ea18c80" Last-Modified Mon, 01 Sep 2014 20:12:18 GMT Server nginx X-Powered-By PleskLin Content-Type image/png X-Accel-Version 0.01 Connection keep-alive Accept-Ranges bytes Content-Length 144
GET H/1.1	200 OK	fsd-arrows.png mindtheshoe.gr/cli/BOA/en/imgs/	246 B 246 B	139ms 72ms	Image image/png	185.4.135.71 TOPHOST-SOUTH
General Check archive.org Show headers Download Go to Show image Full URL http://mindtheshoe.gr/cli/BOA/en/imgs/fsd-arrows.png Requested by Host: mindtheshoe.gr URL: http://mindtheshoe.gr/cli/BOA/en/imgs/login.js Protocol HTTP/1.1 Server 185.4.135.71 , Greece, ASN60342 (TOPHOST-SOUTH, GR), Reverse DNS rlinux19.grserver.gr Software nginx / PleskLin Resource Hash `ec8a7b5d27dd9c4cd59db1c74a73aec065c0660675f7ef26f300ab49e4bb5825` Request headers Referer http://mindtheshoe.gr/cli/BOA/en/imgs/login.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36 Response headers Date Tue, 20 Jun 2017 00:48:17 GMT ETag "e3e923-f6-503c3cf00de80" Last-Modified Tue, 23 Sep 2014 23:20:10 GMT Server nginx X-Powered-By PleskLin Content-Type image/png X-Accel-Version 0.01 Connection keep-alive Accept-Ranges bytes Content-Length 246
GET		cnx-regular.woff mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/ Redirect Chain http://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.woff https://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.woff	0 0

GET		cnx-regular.ttf mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/ Redirect Chain http://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.ttf https://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.ttf	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mindtheshoe.gr
URL: https://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.woff

Domain: mindtheshoe.gr
URL: https://mindtheshoe.gr/pa/global-assets/1.0/font/cnx-regular/cnx-regular.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Bank of America (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mindtheshoe.gr
mindtheshoe.gr
185.4.135.71
0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72
07e4c753ffc2eb5b218c8f022406951f1c052771ffe9b22aecff0e705f4c13f8
092f0fd4ebf0542f944fb3ff4d704bfc308daf374efd1bfe5d7f37e2ac62060c
258b22f458e2e21c3104876ab8fc1b311c116f0692fe04072d2340d19d6bacfb
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01
a8bc6337547a246ef75d1ae66d7ec8a0ed6171c1ba49804a403124e27c8e8452
ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4
cfb41f9d8ff8e769022aacb8807c940d67f124fcfa7f96dd479bf91d505bc46d
ec8a7b5d27dd9c4cd59db1c74a73aec065c0660675f7ef26f300ab49e4bb5825

mindtheshoe.gr Open in urlscan Pro 185.4.135.71 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

12 Requests

8 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

180 kBTransfer

572 kBSize

0 Cookies

4 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

mindtheshoe.gr Open in urlscan Pro
185.4.135.71 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

8 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

180 kB
Transfer

572 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!