gems1005.gemscampus.com
Open in
urlscan Pro
69.195.147.130
Malicious Activity!
Public Scan
Effective URL: https://gems1005.gemscampus.com/wp-temp/index.php
Submission: On July 28 via api from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 22nd 2020. Valid for: 3 months.
This is the only time gems1005.gemscampus.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citibank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2001:4860:480... 2001:4860:4802:38::15 | 15169 (GOOGLE) (GOOGLE) | |
2 | 69.195.147.130 69.195.147.130 | 19969 (JOESDATAC...) (JOESDATACENTER) | |
2 | 104.111.240.21 104.111.240.21 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
4 | 3 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-240-21.deploy.static.akamaitechnologies.com
online.citi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
citi.com
online.citi.com |
45 KB |
2 |
gemscampus.com
gems1005.gemscampus.com |
527 KB |
1 |
secureciti03app.com
1 redirects
secureciti03app.com |
244 B |
4 | 3 |
Domain | Requested by | |
---|---|---|
2 | online.citi.com |
gems1005.gemscampus.com
|
2 | gems1005.gemscampus.com |
gems1005.gemscampus.com
|
1 | secureciti03app.com | 1 redirects |
4 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.citi.com |
www.citicards.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
gems1005.gemscampus.com cPanel, Inc. Certification Authority |
2020-05-22 - 2020-08-20 |
3 months | crt.sh |
online.citibank.com DigiCert SHA2 Extended Validation Server CA |
2020-03-13 - 2022-05-14 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://gems1005.gemscampus.com/wp-temp/index.php
Frame ID: A93062D1B622AAA307A302349F49A1F5
Requests: 5 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://secureciti03app.com/
HTTP 302
https://gems1005.gemscampus.com/wp-temp/index.php Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: View All Credit Cards
Search URL Search Domain Scan URL
Title: 0% Intro APR Credit Cards
Search URL Search Domain Scan URL
Title: Balance Transfer Credit Cards
Search URL Search Domain Scan URL
Title: Rewards Credit Cards
Search URL Search Domain Scan URL
Title: See If You're Pre-Qualified
Search URL Search Domain Scan URL
Title: Small Business Credit Cards
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://secureciti03app.com/
HTTP 302
https://gems1005.gemscampus.com/wp-temp/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
index.php
gems1005.gemscampus.com/wp-temp/ Redirect Chain
|
30 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ |
273 KB 43 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blue-ui.css
gems1005.gemscampus.com/wp-temp/assets/css/ |
496 KB 496 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
429 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citibank (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gems1005.gemscampus.com/ | Name: PHPSESSID Value: 118db276fe6bf04975ed35fb6a1eeb90 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gems1005.gemscampus.com
online.citi.com
secureciti03app.com
104.111.240.21
2001:4860:4802:38::15
69.195.147.130
242cb1fe2274ec738de60067a2c54568126e01792e55d2db82f8cfb48cbb4f24
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
a6f3b574023b1ac9fd18875218a4b0155a9fe2dabcb677082a65dc7f53e3877b
af8850e29c883086b98e59ddede00e9af6922af5d63441790725eb3d644f3184
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7