rbcverify-royalbank.info
Open in
urlscan Pro
193.168.141.146
Malicious Activity!
Public Scan
Submitted URL: http://rbcverify-royalbank.info/
Effective URL: http://rbcverify-royalbank.info/deposit/rbc/Hr17aVaKnN2vYgir
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On October 11 via api from CA — Scanned from CA
Effective URL: http://rbcverify-royalbank.info/deposit/rbc/Hr17aVaKnN2vYgir
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On October 11 via api from CA — Scanned from CA
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 193.168.141.146, located in
Romania and
belongs to ZERGRUSH, RO.
The main domain is rbcverify-royalbank.info.
This is the only time rbcverify-royalbank.info was scanned on urlscan.io!
This is the only time rbcverify-royalbank.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: RBC (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 7 | 193.168.141.146 193.168.141.146 | 39622 (ZERGRUSH) (ZERGRUSH) | |
| 1 | 151.101.66.137 151.101.66.137 | 54113 (FASTLY) (FASTLY) | |
| 8 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
rbcverify-royalbank.info
1 redirects
rbcverify-royalbank.info |
686 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 925 |
30 KB |
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | rbcverify-royalbank.info |
1 redirects
rbcverify-royalbank.info
code.jquery.com |
| 1 | code.jquery.com |
rbcverify-royalbank.info
|
| 8 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| applinks.rbcroyalbank.com |
| itunes.apple.com |
| www.rbcroyalbank.com |
| www1.royalbank.com |
| www1.rbcbank.com |
| caribbean.rbcroyalbank.com |
| www6.rbc.com |
| www.rbcglobaltrade.rbc.com |
| www.rbc.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://rbcverify-royalbank.info/deposit/rbc/Hr17aVaKnN2vYgir
Frame ID: 31068CBF32E08894BE9FFBBDA48376DC
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
RBC Royal Bank – Secure Sign InRBCiconThe svg icon helpThe svg icon help-schevron-downThe svg icon chevron-leftPage URL History Show full URLs
-
http://rbcverify-royalbank.info/
HTTP 302
http://rbcverify-royalbank.info/deposit/rbc/Hr17aVaKnN2vYgir Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
URL: https://applinks.rbcroyalbank.com/RtYB
Title: INSTALL
Title: INSTALL
Search URL Search Domain Scan URL
URL: https://itunes.apple.com/ca/app/rbc-mobile/id407597290?mt=8
Title: View
Title: View
Search URL Search Domain Scan URL
URL: https://www.rbcroyalbank.com/onlinebanking/bankingusertips/notices/as-of-june2022-rbc-online-banking-will-no-longer-support-internet-explorer.html
Title: As of June 2022, RBC Online Banking will no longer support Internet Explorer Opens in a new Tab
Title: As of June 2022, RBC Online Banking will no longer support Internet Explorer Opens in a new Tab
Search URL Search Domain Scan URL
URL: https://www.rbcroyalbank.com/onlinebanking/bankingusertips/notices/online-banking-sign-in-page-will-move-to-a-new-url-starting-march-2022.html
Title: The Online Banking sign-in page will move to a new URL starting March 2022 Opens in a new Tab
Title: The Online Banking sign-in page will move to a new URL starting March 2022 Opens in a new Tab
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/english/netaction/sgne.html
Title: RBC Direct Investing
Title: RBC Direct Investing
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=DSIC
Title: Dominion Securities Online
Title: Dominion Securities Online
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/english/invest-ease/sgne.html
Title: RBC InvestEase
Title: RBC InvestEase
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?CHOICE=Personal&F21=IB&F22=IB&F6=1&F7=IB&GOTO=RewardsRefresh&LANGUAGE=ENGLISH&REQUEST=ErnexLink
Title: RBC Rewards
Title: RBC Rewards
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=PHN
Title: PH&N Investment Counsel
Title: PH&N Investment Counsel
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=ETS
Title: RBC Royal Trust
Title: RBC Royal Trust
Search URL Search Domain Scan URL
URL: https://www1.rbcbank.com//cgi-bin/rbaccess/rbunxcgi?F6=1&F7=NS&F21=IB&F22=CN&REQUEST=CenturaClientSignin&LANGUAGE=ENGLISH
Title: RBC Bank USA
Title: RBC Bank USA
Search URL Search Domain Scan URL
URL: https://caribbean.rbcroyalbank.com/#/login
Title: RBC Caribbean
Title: RBC Caribbean
Search URL Search Domain Scan URL
URL: https://www6.rbc.com/webapp/ukv0/signin/logon.xhtml?lang=en
Title: RBC Express
Title: RBC Express
Search URL Search Domain Scan URL
URL: https://www.rbcglobaltrade.rbc.com/portal/PasswordLogon.jsp?organization=rbc&branding=rbc&locale=en_CA
Title: RBC Global Trade
Title: RBC Global Trade
Search URL Search Domain Scan URL
URL: https://www.rbc.com/canada.html
Title: Other Services
Title: Other Services
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://rbcverify-royalbank.info/
HTTP 302
http://rbcverify-royalbank.info/deposit/rbc/Hr17aVaKnN2vYgir Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
Hr17aVaKnN2vYgir
rbcverify-royalbank.info/deposit/rbc/ Redirect Chain
|
151 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
rbcverify-royalbank.info/assets/rbc/new/ |
2 MB 234 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
actions.js
rbcverify-royalbank.info/assets/js/ |
644 B 636 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loading.gif
rbcverify-royalbank.info/assets/rbc/ |
163 KB 163 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
441 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
561 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
760 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
full-signin-branding.cb150217a344f9cfdf17.jpg
rbcverify-royalbank.info/assets/rbc/new/ |
270 KB 270 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
355 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
action
rbcverify-royalbank.info/apis/lr/ |
25 B 338 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST |
active
rbcverify-royalbank.info/apis/lr/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- rbcverify-royalbank.info
- URL
- http://rbcverify-royalbank.info/apis/lr/active
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: RBC (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| lrbank string| lrinfo1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| rbcverify-royalbank.info/ | Name: PHPSESSID Value: 36c7fo3g0ppo9ds9sfosqrlve4 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
rbcverify-royalbank.info
rbcverify-royalbank.info
151.101.66.137
193.168.141.146
1173f7c561d5791127c2dd03e4228effb2fc2726e1cd73832cb09fbf3db3d3f2
1987de3e4221a7bcd993f01740db12f565208a7eaac1cd138f7352ff7cd2b456
3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033
4a099741603bab19985341e786a58b230d380e046a4b64cffd889944fd0454a8
aa78f941fad055ff3ee821a040dc6157a03d30e5e3c1a6e3c6de6269be7a197c
ab87cafef5b9ee772a9c1c89cbeb70741f70413f6f255ea13e492c7b3c64c285
b6fd9ddd2c6c9fd1e15d5919547441753cd6b9076e16f77d17b861b78c168832
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
e07efed33aec4356ba72efae1eea9fbe1e922bd270ddbd0dd1a028b5a6db4140
f107564e5e4a31791588c91d2fe6a54dbeeec7a8998bde2d131c2a52b9b823a7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e