fldo-bill.online
Open in
urlscan Pro
134.209.0.192
Malicious Activity!
Public Scan
URL:
https://fldo-bill.online/directing/www1.simplii.login.com/index.html
Submission Tags: @ipnigh
Submission: On July 15 via api from GB
Submission Tags: @ipnigh
Submission: On July 15 via api from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 29 HTTP transactions.
The main IP is 134.209.0.192, located in
Santa Clara, United States and
belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US.
The main domain is fldo-bill.online.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 14th 2019. Valid for: 3 months.
This is the only time fldo-bill.online was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on July 14th 2019. Valid for: 3 months.
This is the only time fldo-bill.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Simplii (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 29 | 134.209.0.192 134.209.0.192 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
| 29 | 1 |
29
134.209.0.192
(Santa Clara, United States)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
| fldo-bill.online |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 29 |
fldo-bill.online
fldo-bill.online |
642 KB |
| 29 | 1 |
| Domain | Requested by | |
|---|---|---|
| 29 | fldo-bill.online |
fldo-bill.online
|
| 29 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| fldo-bill.online Let's Encrypt Authority X3 |
2019-07-14 - 2019-10-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fldo-bill.online/directing/www1.simplii.login.com/index.html
Frame ID: 87C7A6BE7241E89F78DF41F0F04F28D5
Requests: 29 HTTP requests in this frame
Screenshot
Detected technologies
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
ZURB Foundation
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+foundation[^>"]+css/i
- html /<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.html
fldo-bill.online/directing/www1.simplii.login.com/ |
83 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
modal.js
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
14 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
foundation.min.css
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
105 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global.min.css
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
all.min.css
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
318 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ConditionalChatLink.css
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
897 B 584 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280.png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280.jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
44 KB 44 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(1).jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
105 KB 106 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(2).jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
108 KB 108 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(3).jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
89 KB 89 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(4).png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(5).jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
68 KB 68 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cibctablecontainer.min.css
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
simplii-tab-icon.png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
925 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(6).jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
34 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(7).jpeg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
6 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(8).png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
749 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(9).png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
362 B 646 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cq5dam.web.1280.1280(10).png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
524 B 808 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
simplii-livechat.png
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
print.css
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
FSAlbertWeb-Regular.woff2
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
34 KB 34 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sign-on-loader.gif
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
original.jpg
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
338 B 338 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icomoon.ttf
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
FSAlbertWeb-Bold.woff2
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
34 KB 34 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
FSAlbertWeb-Thin.woff2
fldo-bill.online/directing/www1.simplii.login.com/login_files/ |
33 KB 34 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icomoon.woff
fldo-bill.online/directing/www1.simplii.login.com/login_files/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
.jpeg%22){kind=link}
.jpeg){kind=link}
.jpeg){kind=link}
.jpeg%22){kind=link}
.jpeg){kind=link}
.jpeg){kind=link}
.jpeg%22){kind=link}
.jpeg){kind=link}
.jpeg){kind=link}
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
.jpeg%22){kind=link}
.jpeg){kind=link}
.jpeg){kind=link}
.jpeg%22){kind=link}
.jpeg){kind=link}
.jpeg){kind=link}
.jpeg%22){kind=link}
.jpeg){kind=link}
.jpeg){kind=link}
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Simplii (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| cc_format function| mod10_check function| MsgBox function| YesNo function| YesNoCancel function| JavaScriptError function| empty function| change0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fldo-bill.online
134.209.0.192
02bc80fc2d158ec8d2e29053cd14801dd8d4ae6cd62e6c1c546531de40dcb580
08f63bcd962fb4015a9461763c3f8ecdd756091260be58910d13abcc24e24337
110d1b8a8c6eeac0b239eb0268253e2de18418de8122b18a69b9dac9e0627c58
1154e417fea2a5c90f0c30b556bfc3e5f27b29d1f4179dbc6ddd07d13aeedad7
24a341bf12c5318d0987cfac4c19b9aebaa82b8f7d1cf4580a16dad5daa048f9
25b43ad2023c61b388a7648ea479177c7fe41d6e10338301e57dbfb528ffbf13
33e680db5ff4a977f7c7f9b9e441740f7d83435ea13e5037627cedbb34c65c3a
35563ffe32c2bcc8b74bb27323a850baaa31b0275ff6ef9a1e3d747e8e2565d6
37e68c06fef6e5710195df5f035ea8fade0d8f23c68ddf89170e1465e392b9ca
3cac4b1254742ce96465863630f4eac5855ab8ae37d7a1b5f053ff9cb53a2ad0
40811788ff09c33d4ad2adc2fc56c09d7bc0ca2dddefd58b3908d6166e69da50
4190a5a115236f4f2b8dfb381b27a9d30e367d40ecc82f745bf6f221d7be4dfa
6222a9a4718e0001093ba14f0e7f890ad4eae6052e64dfd4440be98e5fbeddad
626545d1b5b7ab67e364c5713c72171e579c6287c75188fd6c2b6d2558d6396e
6a062d3f80599a2bdf7a27d7bffd32d819a951857e9728860d0145af72265e96
6b71ecd2e73d7e90094b1a3376e198e324f5c39ca05dd01a7cbcfc86ebdad1e0
93a662a059b55ae5d9a7726464e6718898767cd103fbdad10189f39abff88983
9703f1d563ebd3acde517ebc5ac88f8cff2a6804f74b7f2acff145192d4401e7
97057c0b04b38e37376a8376b69053864b271438cd94e7acc4f9be1b10ef4270
af63664b0b6c816c6bd76447c49c4655a0c2e20a9d3c812add2b9c4c782b4bda
bae388daa980378cd2391a1ed7e7e7a4ef672231a96052dac47975b2b4c51703
c02683ddfe6351d7882fc2a9365970e936de250d1e8ded794c7b143c9ffe2ef6
c969c349198dfe0c31c4c341795e615cfb2843624d743ba7ae9a20d4feb2a886
ca115674af91de0d40b2373b1be0d5ab8c75e5d9037155c6ce784d5a19e28f1f
dd5f402ea65af53a2c6bdf7ff5dd6bd39368015dc96bf842f1ccbfef5c6ef675
dffea72005444ce6c577ada5e1faa5aa8cb8f79814e15311fca74c0165653937
f210b86c7b160bb189c96bb09d6f5bb7f0ba7ea7900b13bf08f071451059187a