billiondollarsminds.com
Open in
urlscan Pro
192.185.104.50
Malicious Activity!
Public Scan
Effective URL: https://billiondollarsminds.com/klb/kybl/
Submission: On June 11 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 11th 2024. Valid for: 3 months.
This is the only time billiondollarsminds.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: KeyBank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.67.128.44 172.67.128.44 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 9 | 192.185.104.50 192.185.104.50 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-104-50.unifiedlayer.com
billiondollarsminds.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
billiondollarsminds.com
2 redirects
billiondollarsminds.com |
100 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3330 |
16 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 461 |
30 KB |
1 |
mub.me
1 redirects
mub.me |
1 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
9 | billiondollarsminds.com |
2 redirects
billiondollarsminds.com
|
1 | stackpath.bootstrapcdn.com |
billiondollarsminds.com
|
1 | ajax.googleapis.com |
billiondollarsminds.com
|
1 | mub.me | 1 redirects |
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
billiondollarsminds.com R3 |
2024-05-11 - 2024-08-09 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-21 - 2024-08-13 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://billiondollarsminds.com/klb/kybl/
Frame ID: EA2DE1DF581E46412AF9CC61232458A7
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
KeybankPage URL History Show full URLs
-
http://mub.me/SfkP
HTTP 307
https://mub.me/SfkP HTTP 302
https://billiondollarsminds.com/klb/kybl HTTP 301
https://billiondollarsminds.com/klb/kybl/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mub.me/SfkP
HTTP 307
https://mub.me/SfkP HTTP 302
https://billiondollarsminds.com/klb/kybl HTTP 301
https://billiondollarsminds.com/klb/kybl/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://billiondollarsminds.com/favicon.ico HTTP 302
- https://billiondollarsminds.com/wp-content/uploads/2022/08/cropped-billfavicon-32x32.png
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
billiondollarsminds.com/klb/kybl/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
billiondollarsminds.com/klb/kybl/assets/bootstrap/css/ |
227 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
billiondollarsminds.com/klb/kybl/assets/css/ |
1 KB 380 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
key_white_logo.png
billiondollarsminds.com/klb/kybl/assets/img/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
key-logo.svg
billiondollarsminds.com/klb/kybl/assets/img/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
billiondollarsminds.com/klb/kybl/assets/bootstrap/js/ |
79 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cropped-billfavicon-32x32.png
billiondollarsminds.com/wp-content/uploads/2022/08/ Redirect Chain
|
3 KB 3 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: KeyBank (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| uidEvent object| bootstrap function| $ function| jQuery number| count function| nextFun function| t function| J3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mub.me/ | Name: XSRF-TOKEN Value: eyJpdiI6IkdGT2tjZ00yRFQ5cEQ1MjhoSTdkYmc9PSIsInZhbHVlIjoid2NyZFpjQ2pvdS8vMTFpd09reFM4V0gralA2YkFMOVdWdXRnbG1KS3pPa1ZseFNDZGNKdWJxUDlpazQxNzBHZ2ZqVWpHekg5akdSbGZHM0tjU2J4VW4vcnI0UzFLOVlPSkFMVGc2Y0dmQjdSNjY5a1BOUjB5Ry8wdG1aRkRQNnciLCJtYWMiOiJjMjYwZGYzYTczOWM5NTRiOWRjMDQyOGRkMWIxN2FkN2JjOGYyZTQ0N2IxNDNiZmNkZDVjZDJiOGZlYTA4ZTlhIiwidGFnIjoiIn0%3D |
|
mub.me/ | Name: mubme_session Value: eyJpdiI6Ino4T1JHMExrcXUzbnpVZVNJa1ZGRmc9PSIsInZhbHVlIjoiNndwSVJrdjZtcENMQmtCRXpqZmtTRVY4RExJK3RTZERieUg1NlRIeS8zZWVJNWxYMVlrZ0djdlkvL2d4ZmF5T3hOdTlPMlc1U0xXU3RXSWhUNzAvdVJyekdacGZ4a1dkaXRCNkNFVnd3Umx1bklLM1RLYUJ0VHRieEp5Y1h6YXkiLCJtYWMiOiJhNTNjODEwMTNlYmU1MWQwYTYxOGJhMjUxNzk5Y2M0ODgyZTU0NTcyYzYyOTNmMjc4OGExMTFjNDA0NjUwMmU0IiwidGFnIjoiIn0%3D |
|
billiondollarsminds.com/ | Name: PHPSESSID Value: 21d6839efc97912c95747c38898dab23 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
billiondollarsminds.com
mub.me
stackpath.bootstrapcdn.com
104.18.11.207
172.67.128.44
192.185.104.50
2a00:1450:4001:830::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07eeecd82d157b4f6d4147ede1b838e77e5e772e74307a3f53cf9c4afdffa15e
3b4b080b4438819e21e302be4b5a4c02b6316da27495604c610f25d3c165225e
4712701bf2f3b3b93bdfc9aa8c2c3e8dbdf6f3c4cbce9fc9a766c7cb5b281e5b
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
66af34efad8ad6be518c955fb42163a9f1178a2f51b6b16e7864a46973b04349
6df503ef64c20f7eef8d52e47a08e1dfa844f4e10f77c76d60ad3436f0ef811a
c9516e9ba8f9d82b755083159b0c11d4dc1b2506573d6e845bff145a08dafad8
f84f90ae8e5eec20eb67f7a59a1c2c94172c7dfd0a5483d6f0ccecdda4b79029