capetownrelief.com
Open in
urlscan Pro
35.177.76.153
Malicious Activity!
Public Scan
Effective URL: https://capetownrelief.com/boa-login/index.php
Submission: On October 21 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 20th 2019. Valid for: 3 months.
This is the only time capetownrelief.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.160.246.24 35.160.246.24 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 17 | 35.177.76.153 35.177.76.153 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
16 | 1 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-160-246-24.us-west-2.compute.amazonaws.com
bankofamerica-d.live |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-177-76-153.eu-west-2.compute.amazonaws.com
capetownrelief.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
capetownrelief.com
1 redirects
capetownrelief.com |
524 KB |
1 |
bankofamerica-d.live
1 redirects
bankofamerica-d.live |
240 B |
16 | 2 |
Domain | Requested by | |
---|---|---|
17 | capetownrelief.com |
1 redirects
capetownrelief.com
|
1 | bankofamerica-d.live | 1 redirects |
16 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
capetownrelief.com cPanel, Inc. Certification Authority |
2019-10-20 - 2020-01-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://capetownrelief.com/boa-login/index.php
Frame ID: BEAA7F7C314FBB65DBD32FC62375FC6B
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://bankofamerica-d.live/
HTTP 307
https://capetownrelief.com/boa-login/dir.php HTTP 302
https://capetownrelief.com/boa-login/index.php Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bankofamerica-d.live/
HTTP 307
https://capetownrelief.com/boa-login/dir.php HTTP 302
https://capetownrelief.com/boa-login/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
index.php
capetownrelief.com/boa-login/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bactouch.css
capetownrelief.com/boa-login/style/ |
101 KB 101 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
toolbar.css
capetownrelief.com/boa-login/style/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bact_listview.css
capetownrelief.com/boa-login/style/ |
48 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
footer.css
capetownrelief.com/boa-login/style/ |
851 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
slidemenu.css
capetownrelief.com/boa-login/style/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.1.min.js
capetownrelief.com/boa-login/script/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobileweb.js
capetownrelief.com/boa-login/script/ |
60 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.maskedinput.min.js
capetownrelief.com/boa-login/script/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prv.png
capetownrelief.com/boa-login/img/ |
60 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eq.png
capetownrelief.com/boa-login/img/ |
59 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cpr.png
capetownrelief.com/boa-login/img/ |
64 KB 64 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header.png
capetownrelief.com/boa-login/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
message.png
capetownrelief.com/boa-login/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
close.png
capetownrelief.com/boa-login/img/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite_input.png
capetownrelief.com/boa-login/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)105 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| globalObj function| popup function| encryptA function| decryptA function| loadWarplet function| confirmPopup function| confirmbottomPopup function| actionSheetPopup function| showSplash function| showBannerMessage function| bannerTemplateStyling function| showSASIBanner function| splashMessage function| loadModule function| loadModuleJS function| getPageFooter function| footerWrapper function| loadTemplate function| leavingAppSignOff function| isValidEntity function| isValidCharWithUnderscore function| isAlphaNumericWithSpaces function| isValidChar function| isAlphaStr function| isAlphaNumWithUnderscoreStr function| isAlphaNumWithSpacesStr function| isDOB function| isDate function| isLessThan13 function| isValidPasscodeSpecialStr function| isValidPasscodeNewSpecialStr function| addAuthValidationRegexes function| initiatedynamicFormatChecker function| onlineIDFormatChecker function| passcodeFormatChecker function| isAlphaNumNewOnlineIdSpecialChars function| isAlphaNumOnlineIdSpecialChars function| maskOnlineId function| setCookie function| getCookie function| deleteCookie function| setCookieObj function| getCookieString function| areCookiesEnabled function| cloneObj function| noScroll function| setDimensions function| resizePopups function| showLoading function| hideLoading function| showListLoading function| hideListLoading function| queryParamsFor function| convertToDefaultDate function| isValidAmount function| scrubLinks function| signOff function| disposeObjects function| sendSignOff function| processConfirmPopup function| checkSignOffMessage function| checkWebTimeout function| resetTimeout function| stopTimeout function| startTimeout function| checkTimeout function| timedOut function| nativeToWebviewTrigger function| updateBarkerCount function| menuItemTally function| setTally function| eliminateAuthVariables function| setSlideOverMenuEvent function| loadSlideMenu function| setPageTitle function| getState function| networkUnavailable function| generateUUID function| altListView function| filterResponse object| blackListCharsMapping function| escapeHtmlChars object| iPadheader object| DeviceName function| detectDeviceInfo function| closeMessage function| makeScroller function| generateCLRequestID function| showCoachMark function| detectSwipeOn function| showToggleSlider function| hideToggleSlider function| encrypt function| triggerBusinessEvent function| detectPinchZoom function| getHolidayList function| sasiBusEvent function| queryString function| getParameterByName function| refreshAccounts function| valid_ca1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
capetownrelief.com/ | Name: PHPSESSID Value: 9a3ef50853ea35515342f7ecc07a5ec1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bankofamerica-d.live
capetownrelief.com
35.160.246.24
35.177.76.153
105296e66a93575f0da4c925e3207eb347c2dd552ec2bfb572070cea45998727
478a4f916db4b66d59ecdcb9dac8a8628d19c72c09263c9547979e77846de4e1
4a25e103d4e9e05ecc60b8b1e206df3323c35e83178386e1631a99646aa73eaa
4ff3863b845ae1a49e8e6d574a19a0185bad6c9a7fa1b86f17de1f165fd8e74e
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
723fca598d0ae1aae3ab72990d04c3b86bc6c18b754f1f58507d39367dd6757b
b23046e43a658d66847d3fb771a26e1673ab267b77427eab293f537de496f7e2
b4062fee456a8a45f649606b87ff0c5557f4c8018b39924dc4c3064fe6064447
b632fa1d4962522b6d07793c4f0a4d863bd520b122c5d10343a4004298d01592
bde4e74a5c3d7d06e5558fa425ff90ac46115940fe49ed242b858be4f71d1c20
c7c2fa48bcc272c726218fc9edfd91d7258c8b7b1a47c874d29355c40a8c4a7e
d1b09a34d6ffa1569b70e6f4f9ad6ec35ee0dd0d9c6342de44fabfee6ef107ce
d45d9a7cacfbeaf2796ec624e328354c3cde35f00518bd5a690429bcefa223dc
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
ed832ecc86f186321cd22b5d2c1ceb7845c52e69fba47801fdbe50c04eafb0ad
fb82877818fa23c8c028053cc5744c5d7947faca82bd50a82b918016499bfb62