sfeaton.gq Open in urlscan Pro
2606:4700:30::681b:971c Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sfeaton.gq/images/headers/sco/mfaAuth.html
Submission: On June 03 via automatic, source openphish (June 3rd 2019, 4:03:32 am UTC)

Summary HTTP 10 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:30::681b:971c, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is sfeaton.gq.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 26th 2019. Valid for: a year.

This is the only time sfeaton.gq was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Scotiabank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
10	2606:4700:30:... 2606:4700:30::681b:971c		13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
10	1

10 2606:4700:30::681b:971c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

sfeaton.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	sfeaton.gq sfeaton.gq	173 KB
10	1

	Domain	Requested by
10	sfeaton.gq	sfeaton.gq
10	1

This site contains links to these domains. Also see Links.

Domain
www.scotiaonline.scotiabank.com
maps.scotiabank.com
mobilebanking.scotiabank.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-05-26` - `2020-05-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sfeaton.gq/images/headers/sco/mfaAuth.html
Frame ID: B39834237684F2103D018603C79C9009
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

173 kB
Transfer

788 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.scotiaonline.scotiabank.com/online/authentication/authentication.bns
Title:

Search URL Search Domain Scan URL

URL: https://www.scotiaonline.scotiabank.com/online/authentication/mfaAuthentication.bns?convid=91042
Title: Help

Search URL Search Domain Scan URL

URL: http://maps.scotiabank.com/en/index.php
Title: Locate Us

Search URL Search Domain Scan URL

URL: https://mobilebanking.scotiabank.com/bankingweb/
Title: Mobile Site

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request mfaAuth.html Show response sfeaton.gq/images/headers/sco/	18 KB 3 KB	883ms 837ms	Document text/html	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `6743a006d9c36337c06b9bd890376a05994c009f15565c4fe8ccffd712ddd538` Request headers :method GET :authority sfeaton.gq :scheme https :path /images/headers/sco/mfaAuth.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 03 Jun 2019 04:03:12 GMT content-type text/html set-cookie __cfduid=d5b711077379529246391489fbfb713711559534591; expires=Tue, 02-Jun-20 04:03:11 GMT; path=/; domain=.sfeaton.gq; HttpOnly last-modified Sun, 28 Apr 2019 20:31:00 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4e0ec69f1ed1d6b5-FRA content-encoding br
GET H2	200	framework.pack.js.download Show response sfeaton.gq/images/headers/sco/mfaAuth_files/	57 KB 16 KB	675ms 674ms	Script application/javascript	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://sfeaton.gq/images/headers/sco/mfaAuth_files/framework.pack.js.download Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `601daeefb8827c77cddd58802053864b893b80914b242fb2269e0d5a243c3d32` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:13 GMT content-encoding br last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type application/javascript status 200 cf-ray 4e0ec6a458b4d6b5-FRA
GET H2	200	loader.css sfeaton.gq/images/headers/sco/mfaAuth_files/	379 KB 60 KB	1293ms 1292ms	Stylesheet text/css	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://sfeaton.gq/images/headers/sco/mfaAuth_files/loader.css Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `43dde9f077213d53f7940eed144785e180895a45c563d14ce2c529f87ec25626` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:13 GMT content-encoding br cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 4e0ec6a458b8d6b5-FRA expires Mon, 03 Jun 2019 08:03:13 GMT
GET H2	200	jquery-ui-1.8.2.custom.css sfeaton.gq/images/headers/sco/mfaAuth_files/	10 KB 2 KB	654ms 653ms	Stylesheet text/css	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://sfeaton.gq/images/headers/sco/mfaAuth_files/jquery-ui-1.8.2.custom.css Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `8251c1d254247b1aa8888ee57024112771625046f92034f0ce262ebdf7f23052` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:13 GMT content-encoding br cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 4e0ec6a458bad6b5-FRA expires Mon, 03 Jun 2019 08:03:13 GMT
GET H2	200	bns-jquery-1.4.2.js.download Show response sfeaton.gq/images/headers/sco/mfaAuth_files/	314 KB 82 KB	175ms 174ms	Script application/javascript	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://sfeaton.gq/images/headers/sco/mfaAuth_files/bns-jquery-1.4.2.js.download Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `cdecae69c3c35ebd75b78d8b6e38d59fc17c790cdca29a6f5cbb87ec648125c3` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:12 GMT content-encoding br last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type application/javascript status 200 cf-ray 4e0ec6a458bcd6b5-FRA
GET H2	200	scotiabank-group-bw.gif sfeaton.gq/images/headers/sco/mfaAuth_files/	2 KB 3 KB	674ms 673ms	Image image/gif	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://sfeaton.gq/images/headers/sco/mfaAuth_files/scotiabank-group-bw.gif Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b48583bc5878d27332c6f751cfd7c9be9268330fb3f61d8af683ba0fa205f58a` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:13 GMT cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4e0ec6a458bdd6b5-FRA content-length 2550 expires Mon, 03 Jun 2019 08:03:13 GMT
GET H2	200	log.png sfeaton.gq/images/headers/sco/	1 KB 1 KB	668ms 667ms	Image image/png	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://sfeaton.gq/images/headers/sco/log.png Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `bd238c8daf30f7f18656d1d020d9242c2fa035a2153d0572b56b7a170f91c0f5` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:13 GMT cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4e0ec6a458bed6b5-FRA content-length 1062 expires Mon, 03 Jun 2019 08:03:13 GMT
GET H2	200	nav-bg.png sfeaton.gq/images/headers/sco/images/nav/	3 KB 3 KB	676ms 676ms	Image image/png	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://sfeaton.gq/images/headers/sco/images/nav/nav-bg.png Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `2290c1d1c885e7ffc5213c5f84fa864552c3640e35b5bfb45140d9f4356a6093` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth_files/loader.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:15 GMT cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4e0ec6aeaccad6b5-FRA content-length 2876 expires Mon, 03 Jun 2019 08:03:15 GMT
GET H2	200	scotiabank-group.gif sfeaton.gq/images/headers/sco/images/branding/	3 KB 3 KB	662ms 661ms	Image image/gif	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://sfeaton.gq/images/headers/sco/images/branding/scotiabank-group.gif Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `4320b7969df049d2ac843edc9d3b5611a6fee6802bde8bcfd97d1cbbafb7b45e` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth_files/loader.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:15 GMT cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4e0ec6aeacccd6b5-FRA content-length 2840 expires Mon, 03 Jun 2019 08:03:15 GMT
GET H2	200	bg_vertical_dotted_line1.png sfeaton.gq/images/headers/sco/images/backgrounds/	77 B 136 B	674ms 673ms	Image image/png	2606:4700:30::681b:971c Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://sfeaton.gq/images/headers/sco/images/backgrounds/bg_vertical_dotted_line1.png Requested by Host: sfeaton.gq URL: https://sfeaton.gq/images/headers/sco/mfaAuth.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:971c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `c6cbdb8e854f700eeb987e01ff817004ed07596e74675b628f1611fe91213369` Request headers Referer https://sfeaton.gq/images/headers/sco/mfaAuth_files/loader.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 03 Jun 2019 04:03:15 GMT cf-cache-status MISS last-modified Sun, 28 Apr 2019 20:31:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4e0ec6aeacced6b5-FRA content-length 77 expires Mon, 03 Jun 2019 08:03:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.sfeaton.gq/	1970-01-19 09:57:50	Name: __cfduid Value: d5b711077379529246391489fbfb713711559534591

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sfeaton.gq
2606:4700:30::681b:971c
2290c1d1c885e7ffc5213c5f84fa864552c3640e35b5bfb45140d9f4356a6093
4320b7969df049d2ac843edc9d3b5611a6fee6802bde8bcfd97d1cbbafb7b45e
43dde9f077213d53f7940eed144785e180895a45c563d14ce2c529f87ec25626
601daeefb8827c77cddd58802053864b893b80914b242fb2269e0d5a243c3d32
6743a006d9c36337c06b9bd890376a05994c009f15565c4fe8ccffd712ddd538
8251c1d254247b1aa8888ee57024112771625046f92034f0ce262ebdf7f23052
b48583bc5878d27332c6f751cfd7c9be9268330fb3f61d8af683ba0fa205f58a
bd238c8daf30f7f18656d1d020d9242c2fa035a2153d0572b56b7a170f91c0f5
c6cbdb8e854f700eeb987e01ff817004ed07596e74675b628f1611fe91213369
cdecae69c3c35ebd75b78d8b6e38d59fc17c790cdca29a6f5cbb87ec648125c3

sfeaton.gq Open in urlscan Pro 2606:4700:30::681b:971c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

173 kBTransfer

788 kBSize

1 Cookies

4 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

23 JavaScript Global Variables

1 Cookies

Indicators

sfeaton.gq Open in urlscan Pro
2606:4700:30::681b:971c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

173 kB
Transfer

788 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!