onlinetransactionsafety.net
Open in
urlscan Pro
169.255.59.27
Malicious Activity!
Public Scan
Submission: On December 04 via automatic, source openphish
Summary
This is the only time onlinetransactionsafety.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 169.255.59.27 169.255.59.27 | 327813 (Web4Africa) (Web4Africa) | |
9 | 1 |
ASN327813 (Web4Africa, ZA)
PTR: oxygen.web4africa.net
onlinetransactionsafety.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
onlinetransactionsafety.net
onlinetransactionsafety.net |
147 KB |
9 | 1 |
Domain | Requested by | |
---|---|---|
9 | onlinetransactionsafety.net |
onlinetransactionsafety.net
|
9 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://onlinetransactionsafety.net/bofa/account1/login/step2.php
Frame ID: CB40BC0F118926FA855AAC708C798A4B
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
step2.php
onlinetransactionsafety.net/bofa/account1/login/ |
13 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ba1.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ba2.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ba3.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b4.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ba4.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
91 KB 92 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ba5.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bo28.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sub.png
onlinetransactionsafety.net/bofa/account1/login/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
onlinetransactionsafety.net
169.255.59.27
04f54972130c8bb6048e7747c372de38f4dc2d8e95d899ecb2cdabcdc00bb115
06629c23cf0706edda29e8d1a364f7ad7506072aca9710d0747e6435d29e21a7
303227a2985f828a351892f9579e657d64efc266c64c3b464de847d8f3a24493
896789a6e8bdc9fde563afafb03262bb0e8710e40a442f5a34b2276b8a857504
8ecd976498bdf8e4c6168c9e5af642f6d828930f0e7ee4ebe0c8a4497d76d21a
ab815f87fa0240dc3c95ad1f2a1c83f271c0db58e6ce5aaa4880e37307fc4b30
e71ddc7466ae1a9314f3f0057637306776b47cc0fb0490f18d8be939baf49ece
efeee9dcd23ca6973f80f09c2b3cdc54be2c14d0ba445e3d5dfc2818c98033c2
f9fca4070dbcf45060d9cc1306c76ffdc71ff26d527401d0192f90d09a35f7df