deskpnsettlecenter72.xyz Open in urlscan Pro
172.67.138.180 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://deskpnsettlecenter72.xyz/
Submission: On October 07 via api (October 7th 2024, 8:25:54 pm UTC) from BE — Scanned from CA

Summary HTTP 6 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 172.67.138.180, located in United States and belongs to CLOUDFLARENET, US. The main domain is deskpnsettlecenter72.xyz.
TLS certificate: Issued by WE1 on October 2nd 2024. Valid for: 3 months.

This is the only time deskpnsettlecenter72.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PNC Financial (Banking)

Domain & IP information

	IP Address		AS Autonomous System
6	172.67.138.180 172.67.138.180		13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2

6 172.67.138.180 (United States)

ASN13335 (CLOUDFLARENET, US)

deskpnsettlecenter72.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	deskpnsettlecenter72.xyz deskpnsettlecenter72.xyz	2 MB
6	1

	Domain	Requested by
6	deskpnsettlecenter72.xyz	deskpnsettlecenter72.xyz
6	1

This site contains links to these domains. Also see Links.

Domain
www.pnc.com
www.onlinebanking.pnc.com
secure.pnc.com
m.pnc.com
play.google.com
apps.apple.com
apps.pnc.com
www.twitter.com
careers.pnc.com
www.facebook.com
twitter.com
www.linkedin.com
www.pinterest.com
www.instagram.com
www.youtube.com

Subject Issuer	Validity	Valid
deskpnsettlecenter72.xyz WE1	`2024-10-02` - `2024-12-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://deskpnsettlecenter72.xyz/
Frame ID: DE8A9B18142F8F857075DAB45CEEA002
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PNC Personal Banking

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

2847 kB
Transfer

5329 kB
Size

0
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://www.pnc.com/en/personal-banking.html

Search URL Search Domain Scan URL

URL: https://www.onlinebanking.pnc.com/alservlet/ForgotUserIdServlet
Title: Forgot ID or Password?

Search URL Search Domain Scan URL

URL: https://secure.pnc.com/web-auth/enrollment/verify-identity
Title: Enroll In Online Banking

Search URL Search Domain Scan URL

URL: https://m.pnc.com/
Title: Sign On to Mobile Banking

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.pnc.ecommerce.mobile
Title: (External)

Search URL Search Domain Scan URL

URL: https://apps.apple.com/us/app/pnc-mobile-banking/id303113127
Title: (External)

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/virtual-wallet-overview.html
Title: Learn More & Apply

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/banking/checking.html?lnksrc=explore
Title: Checking

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/banking/credit-cards.html?lnksrc=explore
Title: Credit Cards

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/banking/savings.html
Title: Savings

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/borrowing/home-lending.html
Title: Home Loans

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/investments-and-retirement/retirement-iras.html
Title: Retirement

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/borrowing/auto-loans.html?lnksrc=explore
Title: Auto Loans

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/lp/financial-wellness.html
Title: Learn more and schedule your Financial Wellness conversation today

Search URL Search Domain Scan URL

URL: https://www.pnc.com/insights/personal-finance/borrow/money-management-tips-for-college-students.html?lnksrc=pnc-insights-feed

Search URL Search Domain Scan URL

URL: https://www.pnc.com/insights/personal-finance/borrow/mortgage-interest-rate-explained.html?lnksrc=pnc-insights-feed

Search URL Search Domain Scan URL

URL: https://www.pnc.com/insights/personal-finance/spend/buying-a-car-in-college.html?lnksrc=pnc-insights-feed

Search URL Search Domain Scan URL

URL: https://www.pnc.com/insights/personal-finance.html?lnksrc=pnc-insights-feed-personal
Title: View More Insights

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/personal-banking/banking/online-and-mobile-banking/mobile-banking.html
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/apps/appointment-setting/schedule-appointment.html?appointmentTypeGroupId=digital&appointmentTypeId=mcas001d&questionId__propid=DOT_HOME
Title: Schedule an Appointment

Search URL Search Domain Scan URL

URL: https://apps.pnc.com/locator/#/search
Title: Find a PNC Branch

Search URL Search Domain Scan URL

URL: https://www.pnc.com/content/dam/pnc-com/pdf/personal/OnlineBanking/olb-service-agreement.pdf
Title: PNC Online Banking Service Agreement

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/privacy-policy.html#CA
Title: Read a summary of privacy rights for California residents

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/small-business.html
Title: SMALL BUSINESS

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/corporate-and-institutional.html
Title: CORPORATE & INSTITUTIONAL

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/customer-service/accessible-banking.html
Title: Accessible Banking

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/customer-service.html
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.twitter.com/PNCBank_Help
Title: @PNCBank_Help

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/customer-service/mobile-app-directory.html
Title: Mobile Apps Directory

Search URL Search Domain Scan URL

URL: https://careers.pnc.com/global/en
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/about-pnc/corporate-responsibility/diversity-and-inclusion.html
Title: Diversity & Inclusion

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/about-pnc/corporate-responsibility/corporate-social-responsibility.html
Title: Corporate Responsibility

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/security-privacy.html
Title: Security

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/terms-and-conditions.html
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://www.pnc.com/en/privacy-policy.html
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pncbank

Search URL Search Domain Scan URL

URL: https://twitter.com/pncbank

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/pnc-bank

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/PNC/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/pncbank/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/pnc

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
21 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response deskpnsettlecenter72.xyz/	4 MB 2 MB	323ms 279ms	Document text/html	172.67.138.180 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deskpnsettlecenter72.xyz/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.180 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b9dda7860cc4a19de73a10029f1507544e11705f0986985c887e406a9d56893c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cf-cache-status DYNAMIC cf-ray 8cf09f513931aac5-YYZ content-encoding br content-type text/html; charset=UTF-8 date Mon, 07 Oct 2024 20:25:46 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tiLJKPwBAZzWdwQ03C6u8KSRIAGTpVji6vkAZ6j5e0qcOozmUWAUp7kQxHX7oZ0eSweX9sXOZbX6OGm1x9mTUkiHaIsD%2BVIxWpIRTOhEiuzF8869RCfxoo8rEs%2Bgty5FkdPH%2FUr2v%2Bqj8QY%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation"
GET H3	200	speculation deskpnsettlecenter72.xyz/cdn-cgi/	128 B 557 B	30ms 29ms	Other application/speculationrules+json	172.67.138.180 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deskpnsettlecenter72.xyz/cdn-cgi/speculation Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.180 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer https://deskpnsettlecenter72.xyz/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X2i4Ouf0upisibtrK2IerKj5TNN7g16w2ywDjcVkwaPGV9RmpXHu1WWK9%2BUOqGIdpElKbC7eSXHeovupmD4P1DSSZGYVPp6dDsVZD6PK0hPQwjuGNk7pOmM1PQ%2FFO1Mlz8l%2FI%2FTX1vy%2Bfps%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cf09f530b89aac5-YYZ access-control-allow-origin https://deskpnsettlecenter72.xyz content-length 128 date Mon, 07 Oct 2024 20:25:46 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b1b8be8cc5d74aa0963fffdd7c5f82ec42380a633616fe0bba277fa48bcd5ac8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	13 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3432229c1a27c41e307edc17f2b3898372f4e7742799a7e632913a5b834be62` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	13 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1b2e00a8bc1911a74cb56f23bbc5c8d90718a72ae70fb31d68f10d26cd2deb45` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	541 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `295838b3dcc2fbf0d1023d9ee5818eef6d45d390fa9a34d56d7b38e8684db32d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	739 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `85df54ae83af1aabf609416c5d96a17f19f20fb42294eac91a340068aac9a27e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H3	404	PNCBrandMed.woff deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/	0 0	221ms 221ms	Font text/html	172.67.138.180 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandMed.woff Requested by Host: deskpnsettlecenter72.xyz URL: https://deskpnsettlecenter72.xyz/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.180 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer https://deskpnsettlecenter72.xyz/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I7BDmUkPtvIQfPpfoNyeDw1kVcHsu%2FHD61oPu8FHiROnbtZpQl53LzD6m%2FGsILRKN%2B9QN1RS%2FBjMag2M11mJ4Se2sS1E9fQ%2BAb2nuwCAEZkNrXi9oOdK8ACQjr3kjK5GBS5D6%2BLV77Nb9E4%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cf09f5b3bcaaac5-YYZ date Mon, 07 Oct 2024 20:25:48 GMT content-type text/html; charset=iso-8859-1 vary Accept-Encoding server cloudflare
GET H3	404	PNCBrandReg.woff deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/	0 0	241ms 240ms	Font text/html	172.67.138.180 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandReg.woff Requested by Host: deskpnsettlecenter72.xyz URL: https://deskpnsettlecenter72.xyz/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.180 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer https://deskpnsettlecenter72.xyz/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3r%2BSD3uLBfzYWrb3BtqmBcAGjudDLm9TPxlELRhJcms6V0ynrys0PCiWR7Rd3WibMFkGFbwbxIPH4YEvS6h8Pr0xGk6RrDbTB%2FsDEgUwWfdOcxOXANN0TU0FKQEiAyeWPRWnGUzhC2Zi2Eo%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cf09f5b3bd0aac5-YYZ alt-svc h3=":443"; ma=86400 date Mon, 07 Oct 2024 20:25:48 GMT content-type text/html; charset=iso-8859-1 vary Accept-Encoding server cloudflare
GET DATA	200 OK	truncated /	311 KB 311 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c5d9c49183cdd250b5282ddf8e8e9272b26fb15348ac8aea037ec45dfbdc53aa` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer Response headers Content-Type application/octet-stream
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `26071a131f5d2d5b3d1b4fb2bd132ffb9ed4e88957c8d864745ebe26027d9827` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	519 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a572d8a690b91a6b2ffd06fe33f6c330e595ef6ab87ca4f85b6c895d9ee5517` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `22a107d137888860f01351849fe2b5c09c9ca2d89d13d7e8000045eb01ade4fe` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `523ec15a96e6686c24052412a18cefdd3ede85e09e94c2d20cfedb9df0fa199a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3d7d4b634eac72679956c451ebcb8b5b0fc4303243d8afc1aa0849ed3e9413a8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `571df2ea0f3714e3dc87ac2673427dc4d4397fe460be421d3fe42401b2f62ded` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	477 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fbc8f7b830032bbca8385c677373b11a3eec5a517f871d1b34dcca5cbfd44294` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e1acb71938e70a2f91403d401acdc43b2781b9603f78f3b135b2e96b4f5b7bd0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `deb50e84b4a2cc29eb409b4168fc1f3e370ad655b4e6a5c15e867a1d7ef38fd7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	100 KB 0		Image image/webp
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b557aeedb91f6f29dad00501484bc6aa1087428cd88facaf14f86d66ba78fc81` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/webp
GET DATA	200 OK	truncated /	115 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c8b8db159cdb44b7e1d701e83dc94b8f7a66bc0177f81fef4d72a733295f8ce` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	195 KB 0		Image image/avif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `65bf891b0a2213422e69200986d46085985b3a3d133a164afe756491c7e18d4a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/avif
GET DATA	200 OK	truncated /	48 KB 0		Image image/avif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `074a5cd694faf8f2d416eeb6785cc88657c8af5e4b7ae5273091732fe00ae501` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/avif
GET DATA	200 OK	truncated /	383 KB 383 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `096a382650b21de3c73d99257b3c58e36f916f2dbbe2a1c6c29d62cb40005821` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer Response headers Content-Type application/octet-stream
GET H3	404	PNCBrandMed.ttf deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/	0 0	231ms 230ms	Font text/html	172.67.138.180 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandMed.ttf Requested by Host: deskpnsettlecenter72.xyz URL: https://deskpnsettlecenter72.xyz/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.180 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer https://deskpnsettlecenter72.xyz/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y274KyNuaEGerI5uvvr9YcXEyWHAXTRLaQWvXMUd10bDhoXpn%2FQhqwqQyRc5ctMdHUHiFm9J0FarXlYOE7EtI2lMmnBGINLxNewCL4%2BWQnlQvknhVtwz0tc0QsVfptjkcEcahTZqeuMJHdo%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cf09f5cad35aac5-YYZ date Mon, 07 Oct 2024 20:25:48 GMT content-type text/html; charset=iso-8859-1 vary Accept-Encoding server cloudflare
GET DATA	200 OK	truncated /	106 KB 106 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `cb0b7d24404b10cb5cbdc891ab5789ac7d00d2e241c26db64422d5437bc383b7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer Response headers Content-Type application/octet-stream
GET H3	404	PNCBrandReg.ttf deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/	0 0	225ms 225ms	Font text/html	172.67.138.180 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandReg.ttf Requested by Host: deskpnsettlecenter72.xyz URL: https://deskpnsettlecenter72.xyz/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.180 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://deskpnsettlecenter72.xyz Referer https://deskpnsettlecenter72.xyz/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status MISS speculation-rules "/cdn-cgi/speculation" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BoGsaQlOeMmbGYcCzUdM8U4z0Jt3WKinp3q7GXcLf%2B%2FPsxYbWY71c5If84YVhFh05NY6RUISh7ie6qmxTN4WQKbcXCCRsBJWtOHojf7GmqFSFxF2DMS4q4m6Yz2jDvcj9HSL4VDOSgy6gT8%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cf09f5ced84aac5-YYZ date Mon, 07 Oct 2024 20:25:48 GMT content-type text/html; charset=iso-8859-1 vary Accept-Encoding server cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PNC Financial (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://deskpnsettlecenter72.xyz/(Line 9759) Message: <link rel=preload> has an invalid `href` value
network	error	URL: https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandMed.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandReg.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandMed.ttf Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://deskpnsettlecenter72.xyz/clientlib-fonts/resources/fonts/pnc-brand/PNCBrandReg.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

deskpnsettlecenter72.xyz
172.67.138.180
074a5cd694faf8f2d416eeb6785cc88657c8af5e4b7ae5273091732fe00ae501
096a382650b21de3c73d99257b3c58e36f916f2dbbe2a1c6c29d62cb40005821
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1b2e00a8bc1911a74cb56f23bbc5c8d90718a72ae70fb31d68f10d26cd2deb45
22a107d137888860f01351849fe2b5c09c9ca2d89d13d7e8000045eb01ade4fe
26071a131f5d2d5b3d1b4fb2bd132ffb9ed4e88957c8d864745ebe26027d9827
295838b3dcc2fbf0d1023d9ee5818eef6d45d390fa9a34d56d7b38e8684db32d
3a572d8a690b91a6b2ffd06fe33f6c330e595ef6ab87ca4f85b6c895d9ee5517
3d7d4b634eac72679956c451ebcb8b5b0fc4303243d8afc1aa0849ed3e9413a8
523ec15a96e6686c24052412a18cefdd3ede85e09e94c2d20cfedb9df0fa199a
571df2ea0f3714e3dc87ac2673427dc4d4397fe460be421d3fe42401b2f62ded
65bf891b0a2213422e69200986d46085985b3a3d133a164afe756491c7e18d4a
6c8b8db159cdb44b7e1d701e83dc94b8f7a66bc0177f81fef4d72a733295f8ce
85df54ae83af1aabf609416c5d96a17f19f20fb42294eac91a340068aac9a27e
b1b8be8cc5d74aa0963fffdd7c5f82ec42380a633616fe0bba277fa48bcd5ac8
b557aeedb91f6f29dad00501484bc6aa1087428cd88facaf14f86d66ba78fc81
b9dda7860cc4a19de73a10029f1507544e11705f0986985c887e406a9d56893c
c3432229c1a27c41e307edc17f2b3898372f4e7742799a7e632913a5b834be62
c5d9c49183cdd250b5282ddf8e8e9272b26fb15348ac8aea037ec45dfbdc53aa
cb0b7d24404b10cb5cbdc891ab5789ac7d00d2e241c26db64422d5437bc383b7
deb50e84b4a2cc29eb409b4168fc1f3e370ad655b4e6a5c15e867a1d7ef38fd7
e1acb71938e70a2f91403d401acdc43b2781b9603f78f3b135b2e96b4f5b7bd0
fbc8f7b830032bbca8385c677373b11a3eec5a517f871d1b34dcca5cbfd44294

deskpnsettlecenter72.xyz Open in urlscan Pro 172.67.138.180 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

2847 kBTransfer

5329 kBSize

0 Cookies

41 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 21 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

5 Console Messages

deskpnsettlecenter72.xyz Open in urlscan Pro
172.67.138.180 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

2847 kB
Transfer

5329 kB
Size

0
Cookies

6 HTTP transactions
21 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!