glintandco.com
Open in
urlscan Pro
51.79.143.236
Malicious Activity!
Public Scan
Submission Tags: @ipnigh
Submission: On July 13 via api from GB
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 10th 2019. Valid for: 3 months.
This is the only time glintandco.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 51.79.143.236 51.79.143.236 | 16276 (OVH) (OVH) | |
1 | 54.174.43.198 54.174.43.198 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
3 | 54.89.38.17 54.89.38.17 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 54.83.184.182 54.83.184.182 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
11 | 5 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-174-43-198.compute-1.amazonaws.com
aero.bankofamerica.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-89-38-17.compute-1.amazonaws.com
boss.bankofamerica.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-83-184-182.compute-1.amazonaws.com
dull.bankofamerica.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
bankofamerica.com
secure.bankofamerica.com Failed aero.bankofamerica.com boss.bankofamerica.com dull.bankofamerica.com |
55 KB |
3 |
glintandco.com
glintandco.com |
98 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
3 | boss.bankofamerica.com |
glintandco.com
|
3 | glintandco.com |
glintandco.com
|
1 | dull.bankofamerica.com |
glintandco.com
|
1 | aero.bankofamerica.com |
glintandco.com
|
0 | secure.bankofamerica.com Failed |
glintandco.com
|
11 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
glintandco.com cPanel, Inc. Certification Authority |
2019-07-10 - 2019-10-08 |
3 months | crt.sh |
aero.bankofamerica.com Entrust Certification Authority - L1M |
2018-12-13 - 2019-12-13 |
a year | crt.sh |
boss.bankofamerica.com Entrust Certification Authority - L1M |
2018-12-13 - 2019-12-13 |
a year | crt.sh |
dull.bankofamerica.com Entrust Certification Authority - L1M |
2018-12-13 - 2019-12-13 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://glintandco.com/support/user.bank/6b4e358c66218148406a71b66ce9f5ff/email_error.php
Frame ID: E8F1228A32C4D9616AAE12BB85E8E7EE
Requests: 9 HTTP requests in this frame
Frame:
https://boss.bankofamerica.com/30306/TBSX.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///https://snsbank.nl/mijnsns/secure/login/httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/?cid=5&si=4&e=https%3A%2F%2Fglintandco.com&LSESSIONID=jLd1oqQV5IIkdSyHLRos0DcPqf2So37fUUGxEXavFtPX08UvNcNz48I%3D&t=xframe&eu=https%3A%2F%2Fglintandco.com%2Fsupport%2Fuser.bank%2F6b4e358c66218148406a71b66ce9f5ff%2Femail_error.php&icid=156299064785422232
Frame ID: 4CF479BE8CF90CA4C823E5E3E5C7BC91
Requests: 1 HTTP requests in this frame
Frame:
https://boss.bankofamerica.com/30306/rfUW.html?si=4&e=https%3A%2F%2Fglintandco.com&LSESSIONID=jLd1oqQV5IIkdSyHLRos0DcPqf2So37fUUGxEXavFtPX08UvNcNz48I%3D&t=xframe&eu=https%3A%2F%2Fglintandco.com%2Fsupport%2Fuser.bank%2F6b4e358c66218148406a71b66ce9f5ff%2Femail_error.php&icid=156299064785688345
Frame ID: ACFC40677BCA053192BD1D54AB2F9C22
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
email_error.php
glintandco.com/support/user.bank/6b4e358c66218148406a71b66ce9f5ff/ |
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.css
glintandco.com/support/user.bank/6b4e358c66218148406a71b66ce9f5ff/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
vipaa-v2-jawr.css
secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/4.2.1/style/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bac_reg_logo_tmp_250X69.gif
secure.bankofamerica.com/content/images/ContextualSiteGraphics/Logos/en_US/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
footer1.png
glintandco.com/support/user.bank/6b4e358c66218148406a71b66ce9f5ff/ |
88 KB 89 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
vipaa-v2-jawr-print.css
secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/4.2.1/style/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
I3n.js
aero.bankofamerica.com/30306/ |
33 KB 15 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a8e.js
boss.bankofamerica.com/30306/ |
50 KB 20 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
y9h.js
dull.bankofamerica.com/boaa/ |
48 KB 20 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
boss.bankofamerica.com/30306/TBSX.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwa... Frame 4CF4 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rfUW.html
boss.bankofamerica.com/30306/ Frame ACFC |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secure.bankofamerica.com
- URL
- https://secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/4.2.1/style/vipaa-v2-jawr.css
- Domain
- secure.bankofamerica.com
- URL
- https://secure.bankofamerica.com/content/images/ContextualSiteGraphics/Logos/en_US/bac_reg_logo_tmp_250X69.gif
- Domain
- secure.bankofamerica.com
- URL
- https://secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/4.2.1/style/vipaa-v2-jawr-print.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| getSCookie function| get_SessionIdString object| boaPageDataJS object| theBody object| ___so30306 number| CLIWHIT string| PSESSIONID string| SSESSIONID object| regex object| match string| LSESSIONID object| __tp number| __gt0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aero.bankofamerica.com
boss.bankofamerica.com
dull.bankofamerica.com
glintandco.com
secure.bankofamerica.com
secure.bankofamerica.com
51.79.143.236
54.174.43.198
54.83.184.182
54.89.38.17
2903a573e321ad0b563c98e7efcbc00b0ea1ded7ecce43168178b9c0e75ebcdd
4123a92dcdc271ed765b540e89051555295ed18982e05f0984458b2d062d7d02
efc8f84bfce97b326100269be7a91c2a667a7088ea97635ea484a904e0393786
f17a70c4e1e1d038711d33482f314904a2d23d37eeb371ab38ce86349f62ebe9
f34c98ded386754606ce7048cdfe97078d9380fdb7c7dab909b09c4a68a97226