royalbank.waysforbank.net
Open in
urlscan Pro
2606:4700:3031::681b:8c97
Malicious Activity!
Public Scan
Submission: On July 17 via manual from CA
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 16th 2020. Valid for: a year.
This is the only time royalbank.waysforbank.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: RBC (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2606:4700:303... 2606:4700:3031::681b:8c97 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
waysforbank.net
royalbank.waysforbank.net |
438 KB |
4 | 1 |
Domain | Requested by | |
---|---|---|
4 | royalbank.waysforbank.net |
royalbank.waysforbank.net
|
4 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rbcgam.com |
www.rbccm.com |
www.rbcits.com |
www.rbc.com |
www.rbcroyalbank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-16 - 2021-07-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://royalbank.waysforbank.net/rbaccess/
Frame ID: 69A9A21CC27A36CBD0517C7E62619049
Requests: 31 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Dynatrace (Analytics) Expand
Detected patterns
- script /dtagent.*\.js/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Global Asset Management
Search URL Search Domain Scan URL
Title: Capital Markets
Search URL Search Domain Scan URL
Title: Investor Services
Search URL Search Domain Scan URL
Title: RBC Labs
Search URL Search Domain Scan URL
Title: About RBC
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
royalbank.waysforbank.net/rbaccess/ |
870 KB 395 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
508 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
836 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
53 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
28 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
28 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
28 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
398 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
427 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
440 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hashtable.js
royalbank.waysforbank.net/rbaccess/ |
13 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fp.js
royalbank.waysforbank.net/rbaccess/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jq.js
royalbank.waysforbank.net/rbaccess/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
42 KB 42 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
259 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
443 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
149 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
22 KB 22 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: RBC (Banking)53 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| randrange function| detectIE function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| TimestampCollector object| UIEventCollector function| UIEvent function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| v3mRSA_GetData function| forceIE89Synchronicity function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.waysforbank.net/ | Name: __cfduid Value: d3cd8adfdd7c87a29fa855f94147d3a461595006358 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
royalbank.waysforbank.net
2606:4700:3031::681b:8c97
0162b06a26916e4a1a828ccffe099e8f96297c4745ac17c5d84277853c2a4943
0ef2e50df6bfbe5633c9211a8f50d224a3286133f6a48a7eb1bc987857ae9c86
128376a684bdd753a94481e70b3f65ab665afb60d56eca7263d9c5ad87e5e3dd
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
169b2c80c3cf9bba841ccd21f0a32cd56cf82b55917b228f0d9354fa5e312479
1c323c6269a284f42a11ab70483a7ef20003570cde175735da4b1e2b0d12b5a7
208bd303e33d60639dbebdf5a93db4f0fb2999bda5c34bb8408679bbb8243197
2b56e3544de25a2bc015f2df367a527d3e1f5691510605d7cb5d06d8c2e7fd6d
463c807898d95421f1d1b08aa1cf30873aa2cfeec128f65946107a2d27700f5b
4ad25cca003756c56d16dbc0b68bc7bf4449a33aeb046eb4d0552990a2cfdb9a
5ebd4e99e10ea98455582e5949a0d1bda24645b23971cd3e322eeea55f9b1c48
657af7581552bd71f795ce717ae163c62507c7fc12dfefae0cf4ed4811f3f2eb
65810b2abb5357e9d521f65bc4270894f90cb4f531b9d48bd202e3562920bfde
678d79fc5f3dd27cbac95bb94fd928d61657f15efe113ad38fba73657b719cc3
6a4cefca46eb1ca796a81fd90f6c8a5c5dc4a8526bde1a9634a833b47221bb3c
776c50dabbcf9967aef068d7ffa38e199a2b9a7e87697750a22ea70344072f32
78920a7468b87496f5d9d3e5ec2bae5ba070c741c6d71eb1e7b3214a92bb353c
7b6b8e7317cab19dee07b5b71622bbd17921fd4aded4768810ff8473d7d93671
7f4d18392bb9ce81f4f568c184c8191987203acf66d9e293f383b07b01f2de8e
8573659e2191285fd760e060f497bcb52a87936f8806251471dbefae13795ca0
89975a8d2b12c99b630a8a3fe1706c153c6be0a7774a7903b74e1ae00802e6b1
96befaf05cf6ca6a182303f85e7e73fbbaef4cb6b564468dfcc5c0e48643b766
a26394f7ede100ca118eff2eda08596275a9839b959c226e15439557a5a80742
a51aaa34a0ed0bbfa7cd4cbfb5060f0c0a277825702f9f87ec921bb1deb0022d
bd9f2a9bacc79d0c23c957e53f8ccb9d344f05be3bdcab7494e748aab37b42e6
d0759263025ff6b8f33da27562e5f1fa2194294bd70a26240fa13fe3b97ccf4d
d96aa24745416f71ce3f0dffea32971e52793c1fc2059005b1ab90819fa72e15
f072f948a69fa01073e7561ffc54019409436fff0deee7c868ca670b2f4b849b
f2cce4ff7e8ebb8c1f11507496360275b8fa81877209e344db62daf65ddd749d
f936c6e03bcd5a1a955e66327e9d13a0a78272359ec9ec1c9f0d49fe02bce69a
f9bc132980c62433dfd76631f5a602fd1bf318141d67ebb6b70b4d3cc92555b0