a.gitresrl.it
Open in
urlscan Pro
92.242.62.65
Malicious Activity!
Public Scan
Submission: On April 26 via automatic, source openphish
Summary
This is the only time a.gitresrl.it was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Scotiabank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
22 | 92.242.62.65 92.242.62.65 | 28870 (DILMAX-AS) (DILMAX-AS) | |
22 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
gitresrl.it
a.gitresrl.it |
133 KB |
22 | 1 |
Domain | Requested by | |
---|---|---|
22 | a.gitresrl.it |
a.gitresrl.it
|
22 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/3738a3f10281b92abed6bf3cc8676f2b/login/?email=info%40westonautoleasing.com
Frame ID: 36229D45CA9C86EB5FBAE65296ADBB88
Requests: 22 HTTP requests in this frame
Screenshot
Detected technologies
Debian (Operating Systems) ExpandDetected patterns
- headers server /Debian/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/3738a3f10281b92abed6bf3cc8676f2b/login/ |
88 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.css
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
22 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
0 280 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item23.gif
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
673 B 957 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item36.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item30.gif
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item34.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
643 B 927 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item37.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
711 B 995 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item22.jpg
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
40 KB 40 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item21.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item39.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item29.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item38.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item27.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
121 B 404 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item28.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
77 B 359 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item43.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
162 B 445 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item32.gif
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item25.png
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/login/ |
160 B 443 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dotsfont.woff
a.gitresrl.it/www.scotiaonline.scotiabank.com/online/authentication/dotfont/ |
2 KB 3 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Scotiabank (Banking)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| _0xa211 function| _kaktys_encode string| link string| bb_link string| query string| full_url string| home string| dir_url string| bid object| texts string| lng object| device function| next__ function| finish__ object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q object| loader_ function| send10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.gitresrl.it
92.242.62.65
1dc148caf3ae416b653bfdcd9847da3642546e9683e164e2e0dc5c0aad6af87f
2290c1d1c885e7ffc5213c5f84fa864552c3640e35b5bfb45140d9f4356a6093
229def774e0909f6ae8d9938c0799f85f9f0d542f4026b68fb7d0d32a0df0ec3
2d9a23892b2627df625128b06f84d39f05c1f8cb910fb194ed8b4d3f5dd90580
2f88a4ff7cc6a7924385fd1b398409b2e9616cfe87699a499d36aa2ddea04a53
408f07113d8d08430067b70f17a6b248ce774dbe7fbf5fefd9037ff517889fd5
4934b284f4237537865e359a0b71ba29065e394af498f5ea6668050da9b0baf7
541a235d37c4ecea24dbd30fb57297f1c97b7fa2a21995bc3e140d02dd58a4fb
6a06948047931a1faaf565bdde3e78d34105cc63011ccf5f14a6f9c82b40d3a5
744a1f4f91613c80cf192f53f37d58a97f2342551fc3688c6c1688ac3de97bad
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ca6ab8f08bd643a1eee32900e4dca2e2d8f56b716f0cf118b7a2f56ccd1f2fd
7d4f9b6d48c4cfb7fef3fcc05217bec0af31d10fa759df0318438910ebba9145
816933517550c1e9fb4ba30176e10832a897b375de17ed22a7d53c7afb5910d3
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8740c4494b7a404a10771da97993b6fee7937220bda2d967b47542f6b499f0ad
9873c5f892ce235e11ec75c7a2aca494a87154ccb8f418c09f2e419484a2af08
a866ce9ac9ebba114e049f347471dffa29a103e5e0e7b8862d5bb788039de5bf
a95fbdabc8d66f969f2e7c05e92b757dcc436c432c69eb4b45192aa68d90c9fd
c6cbdb8e854f700eeb987e01ff817004ed07596e74675b628f1611fe91213369
e1cc1c8c4fd09a4058552eb065797a6a9096315ec8db4277bb67f913c8d1561c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855