parentpriority-authweb072.mylftv.com
Open in
urlscan Pro
34.125.57.145
Malicious Activity!
Public Scan
Effective URL: https://parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/?token=a009ac52205c6194836b23cc18c4fa4b98bcb6b6...
Submission: On November 03 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 3rd 2021. Valid for: 3 months.
This is the only time parentpriority-authweb072.mylftv.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3037::ac43:c969 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 20 | 34.125.57.145 34.125.57.145 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
2 | 54.69.159.212 54.69.159.212 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 23.45.237.66 23.45.237.66 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
23 | 4 |
ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 145.57.125.34.bc.googleusercontent.com
parentpriority-authweb072.mylftv.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-69-159-212.us-west-2.compute.amazonaws.com
ci-mpsnare.iovation.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-237-66.deploy.static.akamaitechnologies.com
www.citi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
mylftv.com
3 redirects
parentpriority-authweb072.mylftv.com |
2 MB |
2 |
iovation.com
ci-mpsnare.iovation.com |
14 KB |
1 |
citi.com
www.citi.com Failed |
3 KB |
1 |
t.ly
1 redirects
t.ly |
1 KB |
23 | 4 |
Domain | Requested by | |
---|---|---|
20 | parentpriority-authweb072.mylftv.com |
3 redirects
parentpriority-authweb072.mylftv.com
|
2 | ci-mpsnare.iovation.com |
parentpriority-authweb072.mylftv.com
ci-mpsnare.iovation.com |
1 | www.citi.com |
parentpriority-authweb072.mylftv.com
|
1 | t.ly | 1 redirects |
23 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.citi.com |
www.citicards.com |
online.citi.com |
citigoldprivateclient.citi.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
parentpriority-authweb072.mylftv.com cPanel, Inc. Certification Authority |
2021-11-03 - 2022-02-01 |
3 months | crt.sh |
ci-mpsnare.iovation.com DigiCert SHA2 Extended Validation Server CA |
2021-04-21 - 2022-05-10 |
a year | crt.sh |
www.citi.com DigiCert SHA2 Extended Validation Server CA |
2019-10-17 - 2022-01-01 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/?token=a009ac52205c6194836b23cc18c4fa4b98bcb6b68d17038edbbb30717dc1f4b4600016000e2a2881b16185fb9debaf5825ddde190c2089ca15bea6bb10352196
Frame ID: 83368DED0B755D08402AC074339A49C3
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Sign On to Your Citi Account - CitibankPage URL History Show full URLs
-
https://t.ly/8tYiL
HTTP 301
https://parentpriority-authweb072.mylftv.com/704310delta0354 HTTP 301
https://parentpriority-authweb072.mylftv.com/704310delta0354/ HTTP 302
https://parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316?token=a009ac52205c6194836b2... HTTP 301
https://parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/?token=a009ac52205c6194836b... Page URL
Page Statistics
17 Outgoing links
These are links going to different origins than the main page.
Title: ATM / Branch
Search URL Search Domain Scan URL
Title: Continuar
Search URL Search Domain Scan URL
Title: CitiĀ® Credit Knowledge Center
Search URL Search Domain Scan URL
Title: Respond to Mail Offer
Search URL Search Domain Scan URL
Title: Savings Made Simple
Search URL Search Domain Scan URL
Title: Mortgage Calculators
Search URL Search Domain Scan URL
Title: Home Equity Calculators
Search URL Search Domain Scan URL
Title: Financial Planning
Search URL Search Domain Scan URL
Title: Market Insights
Search URL Search Domain Scan URL
Title: Investments & Insurance
Search URL Search Domain Scan URL
Title: Find a Wealth Team
Search URL Search Domain Scan URL
Title: Citi Wealth Advisor
Search URL Search Domain Scan URL
Title: Open an Account
Search URL Search Domain Scan URL
Title: Forgot User ID?
Search URL Search Domain Scan URL
Title: Activate a Card
Search URL Search Domain Scan URL
Title: Forgot Password?
Search URL Search Domain Scan URL
Title: Register for Online Access
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://t.ly/8tYiL
HTTP 301
https://parentpriority-authweb072.mylftv.com/704310delta0354 HTTP 301
https://parentpriority-authweb072.mylftv.com/704310delta0354/ HTTP 302
https://parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316?token=a009ac52205c6194836b23cc18c4fa4b98bcb6b68d17038edbbb30717dc1f4b4600016000e2a2881b16185fb9debaf5825ddde190c2089ca15bea6bb10352196 HTTP 301
https://parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/?token=a009ac52205c6194836b23cc18c4fa4b98bcb6b68d17038edbbb30717dc1f4b4600016000e2a2881b16185fb9debaf5825ddde190c2089ca15bea6bb10352196 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/ Redirect Chain
|
306 KB 307 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Light.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Bold.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Interstate-Regular.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.96e48ab9a5610e0bcfb4.css
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/ |
1 MB 1 MB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
snare.js
ci-mpsnare.iovation.com/ |
38 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citilogoredesign.png
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
050-location@2x.svg
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/cbol-pre-login-static-assets/citi-branding-assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_globe_med-grey@2x.svg
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/cbol-pre-login-static-assets/citi-branding-assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.js
ci-mpsnare.iovation.com/script/ |
96 B 610 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LSO_4959.jpg
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/ |
171 KB 171 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.woff
parentpriority-authweb072.mylftv.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.woff
parentpriority-authweb072.mylftv.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.ttf
parentpriority-authweb072.mylftv.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.ttf
parentpriority-authweb072.mylftv.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.woff
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/cds-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.woff
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/cds-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.ttf
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/cds-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.ttf
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/cds-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.woff
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.woff
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Light.ttf
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Interstate-Bold.ttf
parentpriority-authweb072.mylftv.com/704310delta0354/8ec7e3e9b710ecef2098c649532b4316/css/commonui-assets/fonts/interstate/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
- Domain
- www.citi.com
- URL
- https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)70 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler boolean| isSpaPage function| _trackAnalytics object| _dl undefined| head undefined| hideStyle undefined| ua undefined| isIE undefined| syncLoadLinks undefined| waitFor object| citiData number| num string| src object| script string| _i_a string| localObjectName function| __if_a function| __if_b function| __if_c object| _i_d object| _i_o object| _i_z object| _i_aa object| _i_ac object| _i_cr function| __if_d object| io_adp function| __if_e object| _i_dt function| __if_f function| iov_fl_cb function| iov_fl_fn function| iov_fl_get_value function| __if_g object| io_dp function| __if_h function| ioGetBlackbox object| io_cm function| __if_i object| _i_fm object| _i_fn object| _i_fo object| _i_dl object| _i_fp function| __if_j function| __if_k number| _i_fq function| __if_l number| _i_fs function| __if_m string| io_last_error object| IGLOO boolean| io_install_stm boolean| io_install_flash number| io_exclude_stm string| io_stm_cab_url string| io_install_stm_error_handler string| io_flash_needs_update_handler boolean| io_enable_rip object| io_flash_blacklist object| io_flash_whitelist string| io_min_flash_in_firefox_version string| io_min_flash_in_firefox_linux_version string| io_min_flash_version string| _i_dw number| _i_g number| _i_bl4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
t.ly/ | Name: XSRF-TOKEN Value: eyJpdiI6ImN0ZGlZY2I3WTlPOE1scWxlY1NCV3c9PSIsInZhbHVlIjoid285SmN1Mm5KRk04VHBjZ29VKzhFRnNuRW5HZkVZbElZb2VrSnRmR0F0ZzRwNTFyWmEvZTVOVnFUcGFjdzJHcDJ0T3U3V3dDdFRVbXF4QmJEZC95WjQvZ0RIbXhvM0ltWHBnVDJreDRLU2dwYlZkbjhxUVlkZFc5ZDJydHVoRzEiLCJtYWMiOiIwNjU2NDQyZTc0ODVkMjE3NTE3ZWQ3OTQ3MDBhNzVkYWQ0YjNlYTY5ODE4MzBjM2UwNjE0Y2VhMmRhMjEwNDhkIiwidGFnIjoiIn0%3D |
|
t.ly/ | Name: tly_session Value: eyJpdiI6IjVRNWR4NEE3TktSMVY3MDNBcFNpQkE9PSIsInZhbHVlIjoiUllFZkpMUHhzZzFFbENIT0RHMmRSZkNCTVByQzFTR05oUkt5N2E2OWY0MVRCVjFzbnNPYlB0ekYvTXRFV1NxVUNzWVZQbjA0ZTZSekNqbEN1emxzdG9YTS81V3pUdHpKMDcvRFluNVpQQ2dVOXREUjk1ZlI5c1ExWXovK1NhcTQiLCJtYWMiOiJjZmM4NDYyYThjOTM0MTA2NDg2NzNjZTFiODZhNGFiYjQzMTJjYzYxZTBmZTRkYTE2NmIyN2NlNGE3MGZlMTdmIiwidGFnIjoiIn0%3D |
|
parentpriority-authweb072.mylftv.com/ | Name: PHPSESSID Value: 008e1f11ae777c1c1378a0b6f4d03497 |
|
ci-mpsnare.iovation.com/ | Name: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef Value: U85N4Xa1TZDNZSepDxQ6XMaekzDS5N5c4sFKVrZErWI= |
23 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ci-mpsnare.iovation.com
parentpriority-authweb072.mylftv.com
t.ly
www.citi.com
www.citi.com
23.45.237.66
2606:4700:3037::ac43:c969
34.125.57.145
54.69.159.212
0da1539eb622cd69560cd3fbc7c84ecc5cd54f7695ee3b9c21e1999ed563804b
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
4c4bceaa67185ef298cd35996a41cb40513af27624efed661338f11e234f4955
561332c36d9ad60bcc2bae6053b5ce9529e72064abbf436aa49e602716f810b6
67d8977fa568417298ae0d649dfb4ec14a3d8b98bb4ea4f18bba4e0a8f75bfdf
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3