urlscan.io logo urlscan.io
SecurityTrails logo

148.72.247.163 Open in urlscan Pro
148.72.247.163  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Submission: On November 02 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 148.72.247.163, located in Singapore, Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is 148.72.247.163.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 20th 2022. Valid for: 3 months.
This is the only time 148.72.247.163 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Randolph Brooks Federal Credit Union (Banking)

Domain & IP information

IP Address AS Autonomous System
9 148.72.247.163 26496 (AS-26496-...)
1 2a00:1450:400... 15169 (GOOGLE)
11 3
Apex Domain
Subdomains		 Transfer
1 gstatic.com
fonts.gstatic.com
16 KB
0 Failed
function sub() { [native code] }. Failed
11 2
Domain Requested by
1 fonts.gstatic.com 148.72.247.163
0 148.72.247.163 Failed 148.72.247.163
11 2

This site contains no links.

Subject Issuer Validity Valid
163.247.72.148.host.secureserver.net
cPanel, Inc. Certification Authority		 2022-10-20 -
2023-01-18		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-09-26 -
2022-12-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Frame ID: 78DF5E16F18C66ABB9639E4EC9C7662D
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

RBFCU - Sign In

Page Statistics

11
Requests

9 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

402 kB
Transfer

399 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request session_index
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/ 		68 KB
68 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
a341c5cb507b8ff9bd94affb69e35efe78e5b99a755a07b3748927d51592aa5c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Wed, 02 Nov 2022 14:23:33 GMT
Server
nginx
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
icon.css
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		569 B
843 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/icon.css
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
e0c254788ad36f95d44c1786c590263e89ea3976fcbc9ae7c82c52493b254391
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
569
X-XSS-Protection
1; mode=block
cssO.css
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		10 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/cssO.css
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
d69c01432ebe21bfd72cba936738c1ab831ce461de00e229dea799e6f932d510
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10544
X-XSS-Protection
1; mode=block
cssR.css
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		6 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/cssR.css
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:34 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6014
X-XSS-Protection
1; mode=block
icon
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		0
0
styles.f461454e21421afe7503.css
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		189 KB
189 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/styles.f461454e21421afe7503.css
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
f4cf0333d9acf7960e3d2a31a49428dc63626458ba024a98b71d57685c471dc9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:35 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
193629
X-XSS-Protection
1; mode=block
rbfcu-logo.svg
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/rbfcu-logo.svg
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:35 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5383
X-XSS-Protection
1; mode=block
NCUA-logo-gray.svg
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/NCUA-logo-gray.svg
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:35 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
104580
X-XSS-Protection
1; mode=block
EHL-logo-gray.svg
148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/EHL-logo-gray.svg
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:35 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Nov 2022 07:36:37 GMT
Server
nginx
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1613
X-XSS-Protection
1; mode=block
white-phone-header.4a066fd87a48426d8cf5.svg
148.72.247.163/online/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://148.72.247.163/online/white-phone-header.4a066fd87a48426d8cf5.svg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
148.72.247.163 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
163.247.72.148.host.secureserver.net
Software
nginx /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date
Wed, 02 Nov 2022 14:23:36 GMT
Server
nginx
Connection
keep-alive
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: 148.72.247.163
URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/cssR.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://148.72.247.163/
Origin
https://148.72.247.163
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Tue, 01 Nov 2022 14:02:24 GMT
x-content-type-options
nosniff
age
87673
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 01 Nov 2023 14:02:24 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
148.72.247.163
URL
https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Randolph Brooks Federal Credit Union (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

2 Console Messages

Source Level URL
Text
security error URL: https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/session_index
Message:
Refused to apply style from 'https://148.72.247.163/rb/r/c709245ebc7e602e6fcc3e7321dfc336/ses/files/icon' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network error URL: https://148.72.247.163/online/white-phone-header.4a066fd87a48426d8cf5.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block