urlscan.io logo urlscan.io
SecurityTrails logo

user.westbayheritagebank.com Open in urlscan Pro
161.97.73.22  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://user.westbayheritagebank.com/
Effective URL: https://user.westbayheritagebank.com/login.php
Submission: On December 13 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 21 HTTP transactions. The main IP is 161.97.73.22, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is user.westbayheritagebank.com.
TLS certificate: Issued by user.westbayheritagebank.com on December 13th 2022. Valid for: a year.
This is the only time user.westbayheritagebank.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

IP Address AS Autonomous System
1 12 161.97.73.22 51167 (CONTABO)
1 1 172.67.72.223 13335 (CLOUDFLAR...)
1 7 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 151.139.237.124 33438 (STACKPATH)
21 6
12    161.97.73.22 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi406932.contaboserver.net
user.westbayheritagebank.com
1    172.67.72.223 (United States)

ASN13335 (CLOUDFLARENET, US)
code.tidio.co
7    2606:4700:20::681a:88b (United States)

ASN13335 (CLOUDFLARENET, US)
widget-v4.tidiochat.com
assets.tidiochat.com
1    2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    151.139.237.124 (United States)

ASN33438 (STACKPATH, US)
twemoji.maxcdn.com
Apex Domain
Subdomains		 Transfer
12 westbayheritagebank.com
user.westbayheritagebank.com
748 KB
7 tidiochat.com
widget-v4.tidiochat.com — Cisco Umbrella Rank: 16789
assets.tidiochat.com — Cisco Umbrella Rank: 788912
2 MB
2 gstatic.com
fonts.gstatic.com
54 KB
1 maxcdn.com
twemoji.maxcdn.com — Cisco Umbrella Rank: 9787
2 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 37
1 KB
1 tidio.co
code.tidio.co — Cisco Umbrella Rank: 15242
499 B
21 6
Domain Requested by
12 user.westbayheritagebank.com 1 redirects user.westbayheritagebank.com
6 widget-v4.tidiochat.com 1 redirects user.westbayheritagebank.com
code.tidio.co
2 fonts.gstatic.com fonts.googleapis.com
1 twemoji.maxcdn.com
1 assets.tidiochat.com
1 fonts.googleapis.com widget-v4.tidiochat.com
1 code.tidio.co 1 redirects
21 7

This site contains no links.

Subject Issuer Validity Valid
user.westbayheritagebank.com
user.westbayheritagebank.com		 2022-12-13 -
2023-12-13		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-17 -
2023-05-17		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-11-07 -
2023-01-30		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-11-07 -
2023-01-30		 3 months crt.sh
twemoji.maxcdn.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2022-10-11 -
2023-11-09		 a year crt.sh

This page contains 3 frames:

Primary Page: https://user.westbayheritagebank.com/login.php
Frame ID: 9099B4DEB37B664F549937FEBBB721CD
Requests: 13 HTTP requests in this frame

Frame: https://widget-v4.tidiochat.com/1_131_0/static/js/chunk-WidgetIframe-a2ea9bf2d262d5060dc4.js
Frame ID: 4B7D20C9722FC89B351DE9E7C6E4218B
Requests: 4 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css2?family=Mulish:wght@400;600&display=swap
Frame ID: 9ED795B743CBFEE78C55C9F8A461E1B0
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Westbay Heritage Bank | Login

Page URL History Show full URLs

  1. https://user.westbayheritagebank.com/ HTTP 302
    https://user.westbayheritagebank.com/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

21
Requests

43 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

6
IPs

2
Countries

3109 kB
Transfer

3739 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://user.westbayheritagebank.com/ HTTP 302
    https://user.westbayheritagebank.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://code.tidio.co/q0uf1jez3f1i8p05lntumhpczeqzjwyu.js HTTP 302
  • https://widget-v4.tidiochat.com/q0uf1jez3f1i8p05lntumhpczeqzjwyu.js HTTP 302
  • https://widget-v4.tidiochat.com/1_131_0/static/js/render.a2ea9bf2d262d5060dc4.js

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
user.westbayheritagebank.com/
Redirect Chain
  • https://user.westbayheritagebank.com/
  • https://user.westbayheritagebank.com/login.php
3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
fd53a6b1c257b12fb571c4c3905f80874e23cc68d1a431aa98aff048d15c1049

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 13 Dec 2022 20:29:29 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 13 Dec 2022 20:29:29 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Location
login.php
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
Vary
Accept-Encoding
render.a2ea9bf2d262d5060dc4.js
widget-v4.tidiochat.com/1_131_0/static/js/
Redirect Chain
  • https://code.tidio.co/q0uf1jez3f1i8p05lntumhpczeqzjwyu.js
  • https://widget-v4.tidiochat.com/q0uf1jez3f1i8p05lntumhpczeqzjwyu.js
  • https://widget-v4.tidiochat.com/1_131_0/static/js/render.a2ea9bf2d262d5060dc4.js
22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widget-v4.tidiochat.com/1_131_0/static/js/render.a2ea9bf2d262d5060dc4.js
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
H2
Server
2606:4700:20::681a:88b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d6bfdcbff81022f9257db9728a3e39a933c534366e0bd54dab5c01fb8b4ab63

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 20:29:29 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 05 Dec 2022 08:20:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
411
etag
W/"638da9bb-5713"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XkFuS4Yh69vSAKF3pk04Um5xQIpLv5kPAt8JQFBPyQpc5%2F5fqVnwFNIFdGTH280kkPr6czYskZDOzVrCpTjiNzVw8u%2BD66doUvl6eBLjrgKJl%2BlOh1E5fsU6tE3JRh4cAO06lZrH0gc33iWLkVLjV32AbOX2"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=691200
cf-ray
779173c5aa709a21-FRA

Redirect headers

date
Tue, 13 Dec 2022 20:29:29 GMT
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gOKrb2ybTvT9uSISVFQBkQGJ5kq7l13l%2FUvBN%2B%2B6aEMej2zfSdOHbYrCsWN7ioDqi6kStwRVZFORhBGtw4ZgY%2BwR3XUt0zk%2BGGU9rDMUUH%2F5yhuVU8nZ%2FKkehgADiV%2FFwURg%2FzvRylk10PeytIxdl%2FiUucQ2"}],"group":"cf-nel","max_age":604800}
content-type
text/html
location
https://widget-v4.tidiochat.com/1_131_0/static/js/render.a2ea9bf2d262d5060dc4.js
cache-control
private, no-cache, no-store, must-revalidate
cf-ray
779173c4b89e9a21-FRA
select2.min.css
user.westbayheritagebank.com/js/select2/dist/css/ 		15 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/select2/dist/css/select2.min.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
c493991dfa712d1fee861d41c18152e5f8663807484506a23ae97917f6fbbf7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:05 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
15196
daterangepicker.css
user.westbayheritagebank.com/js/bootstrap-daterangepicker/ 		8 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/bootstrap-daterangepicker/daterangepicker.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
9e4450a60b4d6d5b4a8304ade07576767dc3f64f7653b0f95bce43bf11d854b2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
8163
dropzone.css
user.westbayheritagebank.com/js/dropzone/dist/ 		12 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/dropzone/dist/dropzone.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
d19ea63ab74b12d82abe3eed89d6109c26161b71b61802296ad0162a10f1f953

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
12587
dataTables.bootstrap.min.css
user.westbayheritagebank.com/js/datatables.net-bs/css/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/datatables.net-bs/css/dataTables.bootstrap.min.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
b5f6d1473458b6d1ba293ab2352d5bed3454082ab106a15ff9516bfcb577514d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4188
fullcalendar.min.css
user.westbayheritagebank.com/js/fullcalendar/dist/ 		15 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/fullcalendar/dist/fullcalendar.min.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
38eb869b5de1c74d94a38cace11261b88823e75a4bd7c1fdaf5ded519f84bbe0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
15686
perfect-scrollbar.min.css
user.westbayheritagebank.com/js/perfect-scrollbar/css/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/perfect-scrollbar/css/perfect-scrollbar.min.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
85699d57758974089cc0f8428b29460e1fe0326972ca011748443bfdb6cda162

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:05 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4412
slick.css
user.westbayheritagebank.com/js/slick-carousel/slick/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/js/slick-carousel/slick/slick.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:05 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1776
main.css
user.westbayheritagebank.com/css/ 		673 KB
674 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://user.westbayheritagebank.com/css/main.css
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
e19d718ca5d4821f57f4fa5e16e3e3083901fd14ac157b9b993da800a1b655ad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 10 Aug 2021 07:35:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
689631
logo2.png
user.westbayheritagebank.com/img/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://user.westbayheritagebank.com/img/logo2.png
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
b0f2cfe44c540551de1706e334427e425770bfdf3f58cc50493fc184ff2277ad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Last-Modified
Tue, 13 Dec 2022 17:16:49 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
10151
bg-pattern2.png
user.westbayheritagebank.com/img/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://user.westbayheritagebank.com/img/bg-pattern2.png
Requested by
Host: user.westbayheritagebank.com
URL: https://user.westbayheritagebank.com/css/main.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.97.73.22 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi406932.contaboserver.net
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://user.westbayheritagebank.com/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date
Tue, 13 Dec 2022 20:29:29 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=95
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
truncated
/ 		98 KB
98 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
da78dd411a896501b73be9f790e5f197fce590ef3285f4a04ed2c18bcf1ddaba

Request headers

Referer
Origin
https://user.westbayheritagebank.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type
application/x-font-ttf;charset=utf-8
chunk-WidgetIframe-a2ea9bf2d262d5060dc4.js
widget-v4.tidiochat.com/1_131_0/static/js/ Frame 4B7D 		345 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widget-v4.tidiochat.com/1_131_0/static/js/chunk-WidgetIframe-a2ea9bf2d262d5060dc4.js
Requested by
Host: code.tidio.co
URL: https://code.tidio.co/q0uf1jez3f1i8p05lntumhpczeqzjwyu.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:88b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b46edd9de064ab560d77462b2313fbc08749f9f7485fe0c8b8f9e1e6365d641

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 20:29:29 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 05 Dec 2022 08:20:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
404
etag
W/"638da9bb-56229"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JwrcJtccfhzLmYZ%2FL3pj8OCziwC0I1PUqwNVHgRlKZGPEeW18BiM1iAIMb9uSzLabxJyKBwqeicecXiVN8bOW7jFtwXNh4XJcHtT%2BYAGS9tZ%2ByaWVj4pygvbfGsXln%2Bdlksk3tE1V5hS0oihaW0YF6tUnvLr"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=691200
cf-ray
779173c62b969a21-FRA
tururu.mp3
widget-v4.tidiochat.com// Frame 4B7D 		7 KB
7 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://widget-v4.tidiochat.com//tururu.mp3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:88b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
12c7687514ca85ba2157ed61914ac526bb9dd15cb5a2a2d9e4d88f919349284f

Request headers

Referer
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 13 Dec 2022 20:29:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
562272
Content-Range
bytes 0-7223/7224
Content-Length
7224
pragma
public
last-modified
Mon, 05 Dec 2022 08:20:08 GMT
server
cloudflare
etag
"638da9b8-1c38"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uWYeo1M09D3vxxEGTA8hkNmF%2BlMX%2FhzvIEHQY6uUCRb%2F4NoF7a%2FBLt0rjR%2Fe5ZuHWLI02lr0zIdB3QHsOaD3EKpnSRV7xTdWNcZR2B%2FjGPUmY3nXQyTkcNWtahJi8Ml%2F9xuWVfy3e5nuNVc0XzLya3AxRu%2Ft"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
public, max-age=31536000
cf-ray
779173c62b9c9a21-FRA
expires
Wed, 21 Dec 2022 08:18:17 GMT
widget.a2ea9bf2d262d5060dc4.js
widget-v4.tidiochat.com/1_131_0/static/js/ Frame 4B7D 		526 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widget-v4.tidiochat.com/1_131_0/static/js/widget.a2ea9bf2d262d5060dc4.js
Requested by
Host: code.tidio.co
URL: https://code.tidio.co/q0uf1jez3f1i8p05lntumhpczeqzjwyu.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:88b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2835949f34f593797d23b4342db33d11a71aea931472e88c76d3463e658d5cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 20:29:29 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 05 Dec 2022 08:20:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
400
etag
W/"638da9bb-83714"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iij9DXqk9BIuLvskp8KuglvJJEznEtB4PfKe5ypO0L2zdGdnz9nGQ6rDKijFfqCxKKrIVLsNxBJvvsP6nH%2FKL9BHDe22nS1cX4%2BsWXlH1oD1F4RaYaiXs8aYCzph86JABErDGrIQ9tVdzwHjIa3IgO3M7xI%2F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=691200
cf-ray
779173c64bc59a21-FRA
tururu.mp3
widget-v4.tidiochat.com// Frame 4B7D 		7 KB
7 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://widget-v4.tidiochat.com//tururu.mp3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:88b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
12c7687514ca85ba2157ed61914ac526bb9dd15cb5a2a2d9e4d88f919349284f

Request headers

Referer
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 13 Dec 2022 20:29:30 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
562273
Content-Range
bytes 0-7223/7224
Content-Length
7224
pragma
public
last-modified
Mon, 05 Dec 2022 08:20:08 GMT
server
cloudflare
etag
"638da9b8-1c38"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m7ynkFPHvKIqLH8VM43L64hzaB%2Fal7swPYwbQMGinoi7uw4ngS7ed7CTXPar4mtr5FXHaQO0sUF4JnKYFVQcdpQL6S1K%2F3OxQDOxO%2BqDP2t35SESkRf3H%2BobHplRC4LcCHbE%2FzD6oKENa%2B3Gm88x%2BfRc1Gqo"}],"group":"cf-nel","max_age":604800}
content-type
audio/mpeg
cache-control
public, max-age=31536000
cf-ray
779173c75e429a21-FRA
expires
Wed, 21 Dec 2022 08:18:17 GMT
css2
fonts.googleapis.com/ Frame 9ED7 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Mulish:wght@400;600&display=swap
Requested by
Host: widget-v4.tidiochat.com
URL: https://widget-v4.tidiochat.com/1_131_0/static/js/widget.a2ea9bf2d262d5060dc4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b9eda616b81dc5eaa73c8ea68dd4d61c78b28e2b54a05d7936d33742e866993a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 13 Dec 2022 20:29:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 13 Dec 2022 19:43:57 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 13 Dec 2022 20:29:31 GMT
1Ptvg83HX_SGhgqk3wot.woff2
fonts.gstatic.com/s/mulish/v12/ Frame 9ED7 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/mulish/v12/1Ptvg83HX_SGhgqk3wot.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Mulish:wght@400;600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://user.westbayheritagebank.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Thu, 08 Dec 2022 12:50:21 GMT
x-content-type-options
nosniff
age
459550
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27428
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 18:57:51 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Dec 2023 12:50:21 GMT
lead_generation_bot.gif
assets.tidiochat.com/bots/templates/ Frame 9ED7 		2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.tidiochat.com/bots/templates/lead_generation_bot.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:88b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b176e5e3eee7ffcfa0f541d7dbeacad70b1e8b847a29727bcb9f90bf81129826

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Tue, 13 Dec 2022 20:29:31 GMT
cf-cache-status
HIT
last-modified
Mon, 25 Apr 2022 08:49:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
3364
etag
"626660b7-1e28f8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YICqwN4JRSuPFLEtXaJ64HBBE7Aad8M%2FAufTmcA3KSjRShzxSFgQ8sF%2BZzZ1kXni2YwXKsY9UZLhv7JaLaWZQypL1Xcu%2B0N6tkD6Sa7jKNgKrcXDJU53P2ktE5Ggi0wejq4yOvGd6eDbIHLVhfkjk%2FHv"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=691200
accept-ranges
bytes
cf-ray
779173cdeb1e9a21-FRA
content-length
1976568
1Ptvg83HX_SGhgqk3wot.woff2
fonts.gstatic.com/s/mulish/v12/ Frame 9ED7 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/mulish/v12/1Ptvg83HX_SGhgqk3wot.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Mulish:wght@400;600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://user.westbayheritagebank.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date
Thu, 08 Dec 2022 12:50:21 GMT
x-content-type-options
nosniff
age
459550
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27428
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 18:57:51 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Dec 2023 12:50:21 GMT
1f44b.png
twemoji.maxcdn.com/v/13.0.1/72x72/ Frame 9ED7 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://twemoji.maxcdn.com/v/13.0.1/72x72/1f44b.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.139.237.124 , United States, ASN33438 (STACKPATH, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
dfee1561c6e59c90f7a292f90157bae85f75ccb3ae27b655898a51429e3a8910

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-fastly-request-id
eefd65eea0cddf850a09835c1fb9b635923c096d
date
Tue, 13 Dec 2022 20:29:31 GMT
x-proxy-cache
MISS
x-cache
HIT
powered-by
MaxCDN
content-length
1285
last-modified
Thu, 31 Mar 2022 03:24:17 GMT
server
NetDNA-cache/2.2
x-github-request-id
6524:115C:CFCC35:11589E7:6393C0B5
etag
"62451ee1-505"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
permissions-policy
interest-cohort=()
accept-ranges
bytes
x-origin-cache
HIT
expires
Thu, 12 Jan 2023 20:29:31 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontentvisibilityautostatechange object| SENTRY_RELEASE object| tidioChatApi

1 Cookies

Domain/Path Name / Value
user.westbayheritagebank.com/ Name: PHPSESSID
Value: b8c4c3ded5afe33be3465f859dbf1b7a

1 Console Messages

Source Level URL
Text
network error URL: https://user.westbayheritagebank.com/img/bg-pattern2.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.tidiochat.com
code.tidio.co
fonts.googleapis.com
fonts.gstatic.com
twemoji.maxcdn.com
user.westbayheritagebank.com
widget-v4.tidiochat.com
151.139.237.124
161.97.73.22
172.67.72.223
2606:4700:20::681a:88b
2a00:1450:4001:800::200a
2a00:1450:4001:828::2003
0d6bfdcbff81022f9257db9728a3e39a933c534366e0bd54dab5c01fb8b4ab63
12c7687514ca85ba2157ed61914ac526bb9dd15cb5a2a2d9e4d88f919349284f
38eb869b5de1c74d94a38cace11261b88823e75a4bd7c1fdaf5ded519f84bbe0
85699d57758974089cc0f8428b29460e1fe0326972ca011748443bfdb6cda162
8da72dacca3725d500bc789e5f506c76367804eecc46c4249ce0ff822d7a147e
9b46edd9de064ab560d77462b2313fbc08749f9f7485fe0c8b8f9e1e6365d641
9e4450a60b4d6d5b4a8304ade07576767dc3f64f7653b0f95bce43bf11d854b2
a2835949f34f593797d23b4342db33d11a71aea931472e88c76d3463e658d5cb
b0f2cfe44c540551de1706e334427e425770bfdf3f58cc50493fc184ff2277ad
b176e5e3eee7ffcfa0f541d7dbeacad70b1e8b847a29727bcb9f90bf81129826
b5f6d1473458b6d1ba293ab2352d5bed3454082ab106a15ff9516bfcb577514d
b9eda616b81dc5eaa73c8ea68dd4d61c78b28e2b54a05d7936d33742e866993a
c493991dfa712d1fee861d41c18152e5f8663807484506a23ae97917f6fbbf7b
d19ea63ab74b12d82abe3eed89d6109c26161b71b61802296ad0162a10f1f953
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
da78dd411a896501b73be9f790e5f197fce590ef3285f4a04ed2c18bcf1ddaba
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
dfee1561c6e59c90f7a292f90157bae85f75ccb3ae27b655898a51429e3a8910
e19d718ca5d4821f57f4fa5e16e3e3083901fd14ac157b9b993da800a1b655ad
fd53a6b1c257b12fb571c4c3905f80874e23cc68d1a431aa98aff048d15c1049