sigmek.com
Open in
urlscan Pro
96.125.163.12
Malicious Activity!
Public Scan
Submitted URL: https://bit.ly/33xzRAo
Effective URL: https://sigmek.com/account-verification/
Submission: On December 03 via manual from PH
Effective URL: https://sigmek.com/account-verification/
Submission: On December 03 via manual from PH
Summary
This website contacted 3 IPs
in 2 countries
across 4 domains to perform 14 HTTP transactions.
The main IP is 96.125.163.12, located in
Houston, United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is sigmek.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 16th 2020. Valid for: 3 months.
This is the only time sigmek.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on October 16th 2020. Valid for: 3 months.
This is the only time sigmek.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metrobank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 67.199.248.11 67.199.248.11 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
| 1 | 177.36.44.69 177.36.44.69 | 262907 (AVATO TEC...) (AVATO TECNOLOGIA) | |
| 2 13 | 96.125.163.12 96.125.163.12 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 14 | 3 |
1
177.36.44.69
(Uruguaiana, Brazil)
ASN262907 (AVATO TECNOLOGIA, BR)
PTR: mail.uruguaiana.rs.gov.br
ASN262907 (AVATO TECNOLOGIA, BR)
PTR: mail.uruguaiana.rs.gov.br
| arquivohistorico.uruguaiana.rs.gov.br |
13
96.125.163.12
(Houston, United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 96-125-163-12.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 96-125-163-12.unifiedlayer.com
| sigmek.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
sigmek.com
2 redirects
sigmek.com |
148 KB |
| 1 |
uruguaiana.rs.gov.br
arquivohistorico.uruguaiana.rs.gov.br |
508 B |
| 1 |
bit.ly
1 redirects
bit.ly |
271 B |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 14 | 4 |
| Domain | Requested by | |
|---|---|---|
| 13 | sigmek.com |
2 redirects
sigmek.com
|
| 1 | arquivohistorico.uruguaiana.rs.gov.br | |
| 1 | bit.ly | 1 redirects |
| 0 | Failed |
sigmek.com
|
| 14 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| personal.metrobankdirect.com |
| www.metrobank.com.ph |
| www.globalsign.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.nutriamine.organicoslim.com Let's Encrypt Authority X3 |
2020-10-16 - 2021-01-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sigmek.com/account-verification/
Frame ID: 8518EB670D20274A8AD71571F45357CB
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://bit.ly/33xzRAo
HTTP 301
http://arquivohistorico.uruguaiana.rs.gov.br/online.php Page URL
-
https://sigmek.com/login/x/session
HTTP 302
https://sigmek.com/account-verification HTTP 301
https://sigmek.com/account-verification/ Page URL
Detected technologies
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
URL: https://personal.metrobankdirect.com/RetailInternetPortal/enrollment.do#b
Title: Sign Up now!
Title: Sign Up now!
Search URL Search Domain Scan URL
URL: https://personal.metrobankdirect.com/RetailInternetPortal/forgotuseridpassword.do?method=unspecified&pageFrom=forgotUserId&MYCAL=989459af0f906eb4bfebc76933797e726d1ea428#b
Title: Forgot your User ID?
Title: Forgot your User ID?
Search URL Search Domain Scan URL
URL: https://personal.metrobankdirect.com/RetailInternetPortal/forgotuseridpassword.do?method=unspecified&pageFrom=forgotPassword&MYCAL=cc2857ee8c408476af015ca4b68e0735c603872c#b
Title: Forgot your Password?
Title: Forgot your Password?
Search URL Search Domain Scan URL
URL: https://www.metrobank.com.ph/security_center.asp
Title: Security Center
Title: Security Center
Search URL Search Domain Scan URL
URL: https://www.globalsign.com/en-ph/ssl/
Search URL Search Domain Scan URL
URL: https://www.metrobank.com.ph/privacy_policy.asp
Title: Privacy Policy
Title: Privacy Policy
Search URL Search Domain Scan URL
URL: https://www.metrobank.com.ph/terms_of_use.asp
Title: Terms & Conditions
Title: Terms & Conditions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/33xzRAo
HTTP 301
http://arquivohistorico.uruguaiana.rs.gov.br/online.php Page URL
-
https://sigmek.com/login/x/session
HTTP 302
https://sigmek.com/account-verification HTTP 301
https://sigmek.com/account-verification/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bit.ly/33xzRAo HTTP 301
- http://arquivohistorico.uruguaiana.rs.gov.br/online.php
- https://sigmek.com/account-verification/js/jquery-v2.js HTTP 302
- net://:ERR_CONNECTION_REFUSED
- https://sigmek.com/account-verification/img/metrobank-logo.png HTTP 302
- net://:ERR_CONNECTION_REFUSED
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
online.php
arquivohistorico.uruguaiana.rs.gov.br/ Redirect Chain
|
291 B 508 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
sigmek.com/account-verification/ Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reset.css
sigmek.com/account-verification/css/ |
1 KB 727 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
sigmek.com/account-verification/css/ |
31 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-v1.7.1.js
sigmek.com/account-verification/js/ |
92 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
:ERR_CONNECTION_REFUSED
/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jsencrypt.min.js
sigmek.com/account-verification/js/ |
56 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
sigmek.com/account-verification/js/ |
82 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
:ERR_CONNECTION_REFUSED
/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mb-personal-PNG.png
sigmek.com/account-verification/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
view-demo.png
sigmek.com/account-verification/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
siteseal.PNG
sigmek.com/account-verification/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-bg.png
sigmek.com/account-verification/img/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
button-bg-login.png
sigmek.com/account-verification/img/ |
180 B 209 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metrobank (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| JSEncryptExports function| JSEncrypt object| KJUR object| Hex object| Base64 function| ASN1 function| resetdata function| connectToOnlineDemo object| _0xda77 function| loginx1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| sigmek.com/ | Name: PHPSESSID Value: b658b42ac8ec02b295b6107715926b80 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
arquivohistorico.uruguaiana.rs.gov.br
bit.ly
sigmek.com
177.36.44.69
67.199.248.11
96.125.163.12
03f09f6f24e3f2e7806a4e54659ebae4830f1ec2759149126e8bff020764cd72
147e4ac682c6c3eec99db549605f60e847b240a4578c0fe58f78232081b37440
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
5309ca3e99da2e0fa0de2575ea750847db37fd4f4f1dbbda2a513268c702ace3
7c9412acd14c2af021ca2ef9e181a1cd40840b1ad983210a88bc551669f61b8b
87365418a4de7a71c2ea5750e9fc23b1a6f71455840617f65346979b1691a09c
94ec71a783e5461772334f1a7ff1d05a1a672c89c712bbccdd9e79eeabd66b8f
a0461dff82b1b396bd12e3d7945ff362d51d87f4b5d477d7da56f41c4ce7f544
a5d2ce66efae0fde2f825b3dc79ebcd06d67c8e6d3340c6d20a8f81fb77440c2
c0d00a43b4f97120bdd434da2bb1320d64c8b635ee9ed07adf710d8d3400f862
c2ca3ab2adca3e4ba4736cba9bd3cf672ce80d74fdcff565e27b00de7e127ae1
f9becab173013c632f7909a966c124fccbd7e57d76c4f5c232d3f21ed632aac7