ebtpl.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 192.249.119.99, located in United States and belongs to INMOTION, US. The main domain is ebtpl.com.
TLS certificate: Issued by R3 on August 27th 2023. Valid for: 3 months.

This is the only time ebtpl.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aktia Bank (Financial)

Domain & IP information

	IP Address		AS Autonomous System
1 8	192.249.119.99 192.249.119.99		22611 (INMOTION) (INMOTION)
7	1

8 192.249.119.99 (United States) 1 redirects

ASN22611 (INMOTION, US)
PTR: ded4032.inmotionhosting.com

ebtpl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ebtpl.com 1 redirects ebtpl.com	73 KB
7	1

	Domain	Requested by
8	ebtpl.com	1 redirects ebtpl.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid
mail.ebtpl.com R3	`2023-08-27` - `2023-11-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ebtpl.com/akt/
Frame ID: 97ED0BA8B1B98FCF10E16E747CB35B0B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Aktia - tunnistautuminen

Page URL History Show full URLs

https://ebtpl.com/akt HTTP 301
https://ebtpl.com/akt/ Page URL

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

73 kB
Transfer

71 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ebtpl.com/akt HTTP 301
https://ebtpl.com/akt/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response ebtpl.com/akt/ Redirect Chain https://ebtpl.com/akt https://ebtpl.com/akt/	9 KB 10 KB	1041ms 1040ms	Document text/html	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Full URL https://ebtpl.com/akt/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `e7aa1e36a30672eaae1b18f16864cdb69861aeb1bff1c3aebc0c2c6fc1708b32` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 12 Sep 2023 12:14:03 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Length 230 Content-Type text/html; charset=iso-8859-1 Date Tue, 12 Sep 2023 12:14:02 GMT Keep-Alive timeout=5, max=100 Location https://ebtpl.com/akt/ Server Apache
GET H/1.1	200 OK	style.css ebtpl.com/akt/files/	58 KB 59 KB	228ms 228ms	Stylesheet text/css	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Full URL https://ebtpl.com/akt/files/style.css Requested by Host: ebtpl.com URL: https://ebtpl.com/akt/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `f2d3c2dc14b7ad458581bb4440cbf6b59ac5613ad5921dcf38cd14e8f2434449` Request headers accept-language fi-FI,fi;q=0.9 Referer https://ebtpl.com/akt/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Tue, 12 Sep 2023 12:14:03 GMT Last-Modified Tue, 30 Aug 2022 12:23:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 59671
GET H/1.1	200 OK	verkkopankki_logo_fi.png ebtpl.com/akt/files/	2 KB 2 KB	233ms 232ms	Image image/png	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://ebtpl.com/akt/files/verkkopankki_logo_fi.png Requested by Host: ebtpl.com URL: https://ebtpl.com/akt/files/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `ff05cc85a54aa616611e34315f079de33309b3b5b9c0ab571e5eeff36b9a1d08` Request headers accept-language fi-FI,fi;q=0.9 Referer https://ebtpl.com/akt/files/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Tue, 12 Sep 2023 12:14:04 GMT Last-Modified Tue, 30 Aug 2022 12:15:46 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2234
GET H/1.1	500 Internal Server Error	portlet-title-middle.png ebtpl.com/akt/images/	0 169 B	461ms 227ms	Image text/html	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://ebtpl.com/akt/images/portlet-title-middle.png Requested by Host: ebtpl.com URL: https://ebtpl.com/akt/files/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language fi-FI,fi;q=0.9 Referer https://ebtpl.com/akt/files/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Tue, 12 Sep 2023 12:14:04 GMT Server Apache Connection close Content-Length 0 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	menu-item_bg.png ebtpl.com/akt/files/	2 KB 2 KB	663ms 223ms	Image image/png	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://ebtpl.com/akt/files/menu-item_bg.png Requested by Host: ebtpl.com URL: https://ebtpl.com/akt/files/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `a7bf07390624fd80f1cb05a0bcbc20535f518476bf89df74b218b5dd7b8a2a04` Request headers accept-language fi-FI,fi;q=0.9 Referer https://ebtpl.com/akt/files/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Tue, 12 Sep 2023 12:14:04 GMT Last-Modified Tue, 30 Aug 2022 12:22:38 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1764
GET H/1.1	500 Internal Server Error	footer_bg.gif ebtpl.com/akt/images/	0 169 B	1788ms 1347ms	Image text/html	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://ebtpl.com/akt/images/footer_bg.gif Requested by Host: ebtpl.com URL: https://ebtpl.com/akt/files/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language fi-FI,fi;q=0.9 Referer https://ebtpl.com/akt/files/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Tue, 12 Sep 2023 12:14:04 GMT Server Apache Connection close Content-Length 0 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	nuoli.gif ebtpl.com/akt/files/	51 B 292 B	671ms 228ms	Image image/gif	192.249.119.99 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://ebtpl.com/akt/files/nuoli.gif Requested by Host: ebtpl.com URL: https://ebtpl.com/akt/files/style.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.249.119.99 , United States, ASN22611 (INMOTION, US), Reverse DNS ded4032.inmotionhosting.com Software Apache / Resource Hash `d7b2f4d394d1dbdc0d1625daed5d0fb932d5429645ae1db8fd12eecf6d90e238` Request headers accept-language fi-FI,fi;q=0.9 Referer https://ebtpl.com/akt/files/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Tue, 12 Sep 2023 12:14:04 GMT Last-Modified Tue, 30 Aug 2022 12:21:10 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 51

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aktia Bank (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ebtpl.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 064dab30218a90526f027e732d8287ab

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ebtpl.com/akt/images/portlet-title-middle.png Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network	error	URL: https://ebtpl.com/akt/images/footer_bg.gif Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ebtpl.com
192.249.119.99
a7bf07390624fd80f1cb05a0bcbc20535f518476bf89df74b218b5dd7b8a2a04
d7b2f4d394d1dbdc0d1625daed5d0fb932d5429645ae1db8fd12eecf6d90e238
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7aa1e36a30672eaae1b18f16864cdb69861aeb1bff1c3aebc0c2c6fc1708b32
f2d3c2dc14b7ad458581bb4440cbf6b59ac5613ad5921dcf38cd14e8f2434449
ff05cc85a54aa616611e34315f079de33309b3b5b9c0ab571e5eeff36b9a1d08

ebtpl.com Open in urlscan Pro 192.249.119.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

73 kBTransfer

71 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

ebtpl.com Open in urlscan Pro
192.249.119.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

73 kB
Transfer

71 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!