www.securebankofamerica.app Open in urlscan Pro
107.180.119.191 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.securebankofamerica.app/
Submission: On October 24 via automatic, source certstream-suspicious (October 24th 2024, 8:32:42 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 107.180.119.191, located in Ashburn, United States and belongs to GO-DADDY-COM-LLC, US. The main domain is www.securebankofamerica.app.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 24th 2024. Valid for: a year.

This is the only time www.securebankofamerica.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	107.180.119.191 107.180.119.191	398101 (GO-DADDY-...) (GO-DADDY-COM-LLC)
1 2	23.53.42.211 23.53.42.211	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:170... 2a02:26f0:1700:11::b856:6788	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:350... 2a02:26f0:3500:89a::228b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	4

4 107.180.119.191 (Ashburn, United States)

ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 191.119.180.107.host.secureserver.net

www.securebankofamerica.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securebankofamerica.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.53.42.211 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-42-211.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:1700:11::b856:6788 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

events.api.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:89a::228b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

csp.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	secureserver.net events.api.secureserver.net — Cisco Umbrella Rank: 13177 csp.secureserver.net — Cisco Umbrella Rank: 13220	580 B
4	securebankofamerica.app www.securebankofamerica.app securebankofamerica.app	63 KB
2	wsimg.com 1 redirects img1.wsimg.com — Cisco Umbrella Rank: 10296	21 KB
11	3

	Domain	Requested by
4	csp.secureserver.net	img1.wsimg.com
3	securebankofamerica.app	www.securebankofamerica.app
2	events.api.secureserver.net	img1.wsimg.com
2	img1.wsimg.com	1 redirects www.securebankofamerica.app
1	www.securebankofamerica.app
11	5

This site contains no links.

Subject Issuer	Validity	Valid
securebankofamerica.app Go Daddy Secure Certificate Authority - G2	`2024-10-24` - `2025-10-24`	a year	crt.sh
*.api.secureserver.net Starfield Secure Certificate Authority - G2	`2024-07-15` - `2025-08-16`	a year	crt.sh
*.secureserver.net Starfield Secure Certificate Authority - G2	`2024-10-17` - `2025-11-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.securebankofamerica.app/
Frame ID: 704B2E463236DB0D62D314EB5E90ECC7
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bank of America | Log In | User ID

Page Statistics

11
Requests

91 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

84 kB
Transfer

172 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.securebankofamerica.app/ 5 KB
2 KB 476ms
155ms Document
text/html 107.180.119.191
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://www.securebankofamerica.app/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.119.191 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 191.119.180.107.host.secureserver.net
Software: Apache /
Resource Hash: 3c886ef5efa90710de345915e7e89cdcae501478c7272fb6b4537dfb33749643

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 1465
content-type: text/html
date: Thu, 24 Oct 2024 20:32:37 GMT
etag: "15003e2-1304-6253ec60ef93c-br"
last-modified: Thu, 24 Oct 2024 20:23:21 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 BofA_rgb.png
securebankofamerica.app/ 38 KB
39 KB 305ms
304ms Image
image/png 107.180.119.191
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securebankofamerica.app/BofA_rgb.png
Requested by: Host: www.securebankofamerica.app
URL: https://www.securebankofamerica.app/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.119.191 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 191.119.180.107.host.secureserver.net
Software: Apache /
Resource Hash: 30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.securebankofamerica.app/

Response headers

accept-ranges: bytes
content-length: 39422
etag: "15003e0-99fe-6253ec60dc0ba"
date: Thu, 24 Oct 2024 20:32:37 GMT
last-modified: Thu, 24 Oct 2024 20:23:21 GMT
content-type: image/png
server: Apache

GET
H2 200 mobile_llama.png
securebankofamerica.app/ 19 KB
19 KB 303ms
303ms Image
image/png 107.180.119.191
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securebankofamerica.app/mobile_llama.png
Requested by: Host: www.securebankofamerica.app
URL: https://www.securebankofamerica.app/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.119.191 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 191.119.180.107.host.secureserver.net
Software: Apache /
Resource Hash: 6bb1d4b1b719488b9812d1fb67b41b03857eec8f4e0a4d46a8066574037d817a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.securebankofamerica.app/

Response headers

accept-ranges: bytes
content-length: 19167
etag: "15003e5-4adf-6253ec6136613"
date: Thu, 24 Oct 2024 20:32:37 GMT
last-modified: Thu, 24 Oct 2024 20:23:21 GMT
content-type: image/png
server: Apache

GET
H2

200

scc-c2.min.js Show response
img1.wsimg.com/signals/js/clients/scc-c2/
Redirect Chain

https://img1.wsimg.com/traffic-assets/js/tccl.min.js
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

105 KB
21 KB

12ms
12ms

Script
text/javascript

23.53.42.211
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
Requested by: Host: www.securebankofamerica.app
URL: https://www.securebankofamerica.app/
Protocol: H2
Server: 23.53.42.211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-42-211.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1b4dacb0dafda81d48ee0890ea113b3b8275bf2d16d5325f971f16eb75f7218a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.securebankofamerica.app/

Response headers

content-encoding: gzip
x-amz-meta-version: 0.4.7
etag: "6a7950cc31489069917bf817b62b2bfe"
x-amz-version-id: 4pexUB2ckSZgPfbjokD3loiC8DEV2lsi
expires: Thu, 24 Oct 2024 21:02:37 GMT
date: Thu, 24 Oct 2024 20:32:37 GMT
last-modified: Tue, 24 Sep 2024 20:55:06 GMT
content-type: text/javascript
vary: Accept-Encoding
x-amz-id-2: QzDvbQPoC/yd79cRYoiDycnbcXh2pSFm1kZVkCYVTGf1LaJCMTtIuUb9W5RhaUG/ykPbw3BtR3s=
cache-control: max-age=1800
timing-allow-origin: *
x-amz-request-id: VGKSC2ZC5C6TW48G
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20968
x-amz-server-side-encryption: AES256

Redirect headers

expires: Fri, 24 Oct 2025 20:32:37 GMT
cache-control: max-age=31536000
location: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
content-length: 0
access-control-allow-origin: *
date: Thu, 24 Oct 2024 20:32:37 GMT
timing-allow-origin: *

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
290 B 158ms
99ms Fetch
image/gif 2a02:26f0:1700:11::b856:6788
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:11::b856:6788 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.securebankofamerica.app/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-robots-tag: noindex, nofollow
cache-control: private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://www.securebankofamerica.app
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 24 Oct 2024 20:32:38 GMT
content-type: image/gif
x-frame-options: DENY

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
290 B 160ms
102ms Fetch
image/gif 2a02:26f0:1700:11::b856:6788
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?dh=www.securebankofamerica.app&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F130.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=0.4.7&vg=0a275282-3e4d-4e45-97f6-7595b3360d53&vtg=0a275282-3e4d-4e45-97f6-7595b3360d53&dp=%2F&trace_id=c207edb383524abaaa2fbec6f5d3df4d&cts=2024-10-24T20%3A32%3A38.151Z&hit_id=8a48b665-206e-458d-9bf5-a3f858ccf177&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl505504%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%2210108836%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=851068572&z=1362171323&tce=1729801957526&tcs=1729801957226&tdc=1729801958149&tdclee=1729801957797&tdcles=1729801957797&tdi=1729801957797&tdl=1729801957688&tdle=1729801957226&tdls=1729801957205&tfs=1729801957205&tns=1729801957205&trqs=1729801957526&tre=1729801957684&trps=1729801957681&tles=1729801958149&tlee=0&nt=navigate&LCP=539&nav_type=hard

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:11::b856:6788 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.securebankofamerica.app/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-robots-tag: noindex, nofollow
cache-control: private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: https://www.securebankofamerica.app
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 24 Oct 2024 20:32:38 GMT
content-type: image/gif
x-frame-options: DENY

GET
H2 200 images.png
securebankofamerica.app/ 4 KB
4 KB 177ms
177ms Other
image/png 107.180.119.191
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://securebankofamerica.app/images.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.119.191 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 191.119.180.107.host.secureserver.net
Software: Apache /
Resource Hash: ce8df1b5b650c2ad27b416cf086e4bdffafda969933783ebbdd97e9802ab7d43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://www.securebankofamerica.app/

Response headers

accept-ranges: bytes
content-length: 4079
etag: "15003e4-fef-6253ec6116a40"
date: Thu, 24 Oct 2024 20:32:38 GMT
last-modified: Thu, 24 Oct 2024 20:23:21 GMT
content-type: image/png
server: Apache

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 209ms
207ms Fetch
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Authorization: api-key b18ef4f046435b64a469b32c3c1c20a3
Referer: https://www.securebankofamerica.app/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
Cache-Control: max-age=0, no-cache, no-store
x-amz-apigw-id: ALBEGE5UIAMEnuQ=
x-envoy-upstream-service-time: 91
Pragma: no-cache
x-amzn-trace-id: Root=1-671aaee6-4c440a314d25d34a3e57b610
Connection: keep-alive
x-amzn-requestid: 29d783c6-0ae7-4dc9-ac39-4f2aa1b484cb
Expires: Thu, 24 Oct 2024 20:32:38 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 24 Oct 2024 20:32:38 GMT
Content-Type: application/json

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 254ms
252ms Fetch
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Authorization: api-key 8da2217409854bee82e12dc4ca0b39fb
Referer: https://www.securebankofamerica.app/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
Cache-Control: max-age=0, no-cache, no-store
x-amz-apigw-id: ALBEGHnWoAMEsOA=
x-envoy-upstream-service-time: 94
Pragma: no-cache
x-amzn-trace-id: Root=1-671aaee6-4c715d5f2c39bd0e5410365c
Connection: keep-alive
x-amzn-requestid: cde13208-b406-4be9-b3c4-9f3ba84d23f8
Expires: Thu, 24 Oct 2024 20:32:38 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 24 Oct 2024 20:32:38 GMT
Content-Type: application/json

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ 0
0 155ms
117ms Preflight
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.securebankofamerica.app
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Thu, 24 Oct 2024 20:32:38 GMT
Expires: Thu, 24 Oct 2024 20:32:38 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: ALBEEHWooAMEqiw=
x-amzn-requestid: 5cad28b5-4672-438a-a0e5-45a8dd133144
x-amzn-trace-id: Root=1-671aaee6-22731056250e661002e2d32f
x-envoy-upstream-service-time: 8

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ 0
0 168ms
131ms Preflight
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.securebankofamerica.app
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Thu, 24 Oct 2024 20:32:38 GMT
Expires: Thu, 24 Oct 2024 20:32:38 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: ALBEEGBuoAMEGJA=
x-amzn-requestid: c0058264-9458-4ca8-9711-78f872457345
x-amzn-trace-id: Root=1-671aaee6-6f0f7219490fbfc26228ae98
x-envoy-upstream-service-time: 5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.securebankofamerica.app/	1970-01-21 09:15:37	Name: _tccl_visitor Value: 0a275282-3e4d-4e45-97f6-7595b3360d53
.securebankofamerica.app/	1970-01-21 00:30:03	Name: _tccl_visit Value: 0a275282-3e4d-4e45-97f6-7595b3360d53
.securebankofamerica.app/	1970-01-21 00:30:03	Name: _scc_session Value: pc=1&C_TOUCH=2024-10-24T20:32:37.795Z

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://www.securebankofamerica.app/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

csp.secureserver.net
events.api.secureserver.net
img1.wsimg.com
securebankofamerica.app
www.securebankofamerica.app
107.180.119.191
23.53.42.211
2a02:26f0:1700:11::b856:6788
2a02:26f0:3500:89a::228b
1b4dacb0dafda81d48ee0890ea113b3b8275bf2d16d5325f971f16eb75f7218a
30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787
3c886ef5efa90710de345915e7e89cdcae501478c7272fb6b4537dfb33749643
6bb1d4b1b719488b9812d1fb67b41b03857eec8f4e0a4d46a8066574037d817a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ce8df1b5b650c2ad27b416cf086e4bdffafda969933783ebbdd97e9802ab7d43

www.securebankofamerica.app Open in urlscan Pro 107.180.119.191 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

91 %HTTPS

50 %IPv6

3 Domains

5 Subdomains

4 IPs

2 Countries

84 kBTransfer

172 kBSize

3 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

www.securebankofamerica.app Open in urlscan Pro
107.180.119.191 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

91 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

84 kB
Transfer

172 kB
Size

3
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!