bankofamerica.singletact.com
Open in
urlscan Pro
107.180.41.126
Malicious Activity!
Public Scan
Submitted URL: http://bankofamerica.singletact.com/
Effective URL: http://bankofamerica.singletact.com/signin.php?cmd=login_submit&id=320cd199510e317eee2757ce6f42a4cf320cd199510e317eee2757ce6f42a4cf&...
Submission: On March 28 via api from US — Scanned from US
Effective URL: http://bankofamerica.singletact.com/signin.php?cmd=login_submit&id=320cd199510e317eee2757ce6f42a4cf320cd199510e317eee2757ce6f42a4cf&...
Submission: On March 28 via api from US — Scanned from US
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 8 HTTP transactions.
The main IP is 107.180.41.126, located in
Ashburn, United States and
belongs to AS-26496-GO-DADDY-COM-LLC, US.
The main domain is bankofamerica.singletact.com.
This is the only time bankofamerica.singletact.com was scanned on urlscan.io!
This is the only time bankofamerica.singletact.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: M&T Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 9 | 107.180.41.126 107.180.41.126 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
| 8 | 1 |
9
107.180.41.126
(Ashburn, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 126.41.180.107.host.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 126.41.180.107.host.secureserver.net
| bankofamerica.singletact.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
singletact.com
1 redirects
bankofamerica.singletact.com |
171 KB |
| 8 | 1 |
| Domain | Requested by | |
|---|---|---|
| 9 | bankofamerica.singletact.com |
1 redirects
bankofamerica.singletact.com
|
| 8 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://bankofamerica.singletact.com/signin.php?cmd=login_submit&id=320cd199510e317eee2757ce6f42a4cf320cd199510e317eee2757ce6f42a4cf&session=320cd199510e317eee2757ce6f42a4cf320cd199510e317eee2757ce6f42a4cf
Frame ID: FC9089249BB6A304030AB8766BC27AB0
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Welcome to Online Banking | M&T BankPage URL History Show full URLs
-
http://bankofamerica.singletact.com/
HTTP 302
http://bankofamerica.singletact.com/signin.php?cmd=login_submit&id=320cd199510e317eee2757ce6f42a4cf320cd199510e3... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bankofamerica.singletact.com/
HTTP 302
http://bankofamerica.singletact.com/signin.php?cmd=login_submit&id=320cd199510e317eee2757ce6f42a4cf320cd199510e317eee2757ce6f42a4cf&session=320cd199510e317eee2757ce6f42a4cf320cd199510e317eee2757ce6f42a4cf Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
signin.php
bankofamerica.singletact.com/ Redirect Chain
|
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
bankofamerica.singletact.com/xAssets/login_files/ |
252 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mtb-logo.svg
bankofamerica.singletact.com/xAssets/login_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mtb-equalhousinglender.svg
bankofamerica.singletact.com/xAssets/login_files/ |
230 B 550 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mtb-entrust.svg
bankofamerica.singletact.com/xAssets/login_files/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mandtbaltoweb-book.woff
bankofamerica.singletact.com/xAssets/login_files/ |
66 KB 66 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mandtpg-iconfont.woff
bankofamerica.singletact.com/xAssets/login_files/ |
5 KB 5 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mandtbaltoweb-medium.woff
bankofamerica.singletact.com/xAssets/login_files/ |
63 KB 63 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: M&T Bank (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| bankofamerica.singletact.com/ | Name: PHPSESSID Value: 523e5d4e2de8b68e12f0f550f9efe4df |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bankofamerica.singletact.com
107.180.41.126
13cd97f61b02de2037eda5cdf7a163e560ba5ceb2685569189bf15396398c32a
3da3bf82cf85523c61d3fd62f112a1894d5ce3235d080979d1d23804ceb229b2
4029a5a081992259f4e529190b49dbba893931da4e843dd203449f1b9a4509d2
46ebb1ea208b5cd44e87fa4123218222749013e3787c729b567f40531460bf5e
5f5b0d9f678fe446631a33a4cbbe891a01b0ed972143702e67ae6617367096ac
b2ef3bd17aa6bc2daa7b1209f7848b30c64f3068e43162b09a216639ab430ce5
b391b55f950528937beee7687717a4aef81196817834f1c93b099713ff738fbc
d58eb2802f72d0c6b1d944a1335e8fb914af44b51fe16097aad994c15b8cfbad