mo-servis.com
Open in
urlscan Pro
2606:4700:30::681c:1f7c
Malicious Activity!
Public Scan
Submission: On February 12 via automatic, source openphish
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on January 29th 2019. Valid for: 6 months.
This is the only time mo-servis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: GTBank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
25 | 2606:4700:30:... 2606:4700:30::681c:1f7c | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
26 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
mo-servis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
mo-servis.com
mo-servis.com |
124 KB |
0 |
gtbank.com
Failed
iss.gtbank.com Failed |
|
26 | 2 |
Domain | Requested by | |
---|---|---|
25 | mo-servis.com |
mo-servis.com
|
0 | iss.gtbank.com Failed |
mo-servis.com
|
26 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
livechat.gtbank.com. |
www.gtbank.com |
www.facebook.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni185271.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-01-29 - 2019-08-07 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx.php
Frame ID: 8A7F653F056FD8D2C9ADE2AC63DF5CF7
Requests: 26 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: READ MORE
Search URL Search Domain Scan URL
Title: GET YOURS
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: GTBANK.COM
Search URL Search Domain Scan URL
Title: TERMS & CONDITIONS
Search URL Search Domain Scan URL
Title: WHISTLE BLOWER
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.aspx.php
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/ |
47 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Main.css
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
21 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
90 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
k1Y.js
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
25 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajaxScript.js
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
1 KB 520 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
respond.js
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qU1.htm
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
295 B 264 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qU1_002.htm
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
295 B 262 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.js
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
15 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner.gif
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
livechaticon.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad_trsf.gif
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad_balance.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad_balance_768.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad_social.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad_social_768.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AirlinePayment.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/login.aspx_files/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
hI5.js
iss.gtbank.com/24684/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ibtext2.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gradbg.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
183 B 245 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
greenbg.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
519 B 582 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keybg.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
147 B 232 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footbg.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
331 B 390 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shield.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
token.png
mo-servis.com//gt/Ibanking/Ibankingcom/Ibanking.com/main/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- iss.gtbank.com
- URL
- https://iss.gtbank.com/24684/hI5.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: GTBank (Banking)152 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| TokenSubmission function| tokenSubmit function| callSubmit function| findPrimes function| millerRabin function| bitSize function| randTruePrime function| randBigInt function| GCD function| inverseMod function| inverseModInt function| eGCD function| negative function| greaterShift function| greater function| divide function| carry function| modInt function| int2bigInt function| str2bigInt function| equalsInt function| equals function| isZero function| bigInt2str function| dup function| copy function| copyInt function| addInt function| rightShift function| halve function| leftShift function| multInt function| divInt function| linComb function| linCombShift function| addShift function| subShift function| sub function| add function| mult function| mod function| multMod function| squareMod function| trim function| powMod function| mont function| Encrypt number| bpe number| mask number| radix string| digitsStr object| buff object| one object| t object| ss object| s0 object| s1 object| s2 object| s3 object| s4 object| s5 object| s6 object| s7 object| T object| sa object| mr_x1 object| mr_r object| mr_a object| eg_v object| eg_u object| eg_A object| eg_B object| eg_C object| eg_D object| md_q1 object| md_q2 object| md_q3 object| md_r object| md_r1 object| md_r2 object| md_tt object| primes object| pows object| s_i object| s_i2 object| s_R object| s_rm object| s_q object| s_n1 object| s_a object| s_r2 object| s_n object| s_b object| s_d object| s_x1 object| s_x2 object| s_aa object| ___so24684 string| LSESSIONID object| respond object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection object| __callbackTextTypes function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY function| focusToInput function| numClicked function| delClicked function| clrClicked function| managepwd function| getPassword object| jQuery1910242698839373297841 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.mo-servis.com/ | Name: __cfduid Value: de294cb90c283db0f57b139531607ae241549966212 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
iss.gtbank.com
mo-servis.com
iss.gtbank.com
2606:4700:30::681c:1f7c
03ad643c57cd4203deba4eb1a45d293e9398f56798d01bb8fb50076c5170c897
0ee633c8ce015646a8ac1dba78e4349c5e6288805e987a58775ea4a009b9db56
0f3651900fa174dbf7a91e704bd3e5beb8fee7a5e008f92aad34aeb59302d9f2
1350a727c6d452e7e57801b6a0e6ddc3dad041d075a383159755a970229d4d2c
24b1cdbddf9e41962a5f6b4ee2ba0facffcad74ef837c5552cdeca249b4886e7
4c67a4457b9db64a089f800c5e61fce72d3913b825f626ab4a327552811d13f6
53920bb8e98d002e6b57db8a516efe8835c6bda241020cc64ffad5ef4c5c28f9
666f1dbefe9c79a10033a36a1bb0f3da44f756cc643bc736d63e31a0721bccdd
736f03dc62c4d15eb44d93effa1b31bedfc4ad84db8f95d6e33eef2a8196b558
743a83264054a31c77a0a44d2f81e2527d057deed27ea4904865809fcdb18375
7dfcf6b9e7255a2aae21f8cc1b06acd9433ea67aa5c5fdc43d693d9b6b4f052f
7e16582a16be2d118e7f7f44d86c01f8c903255a75c329db5da328945577a90b
7ef5895fcfa5dfd2a2d297a6236ac0f375ef4831abc7e4f7903bb7a5617913e0
82b0d37da2dc26e64e5afae54b3c708fb49ee464bc8c58ec1ab01559c700776b
8356754f7a7240986d4cc59157aafea4258eea9d2a56550ea19d08a60a4af73c
9a7ca670add876603d9cfa2e106953f42d420ee481ff01ebabe686e97d902539
aaeaf8ebf5b61080b3e1f7e675c85a42e051d4edb6183efb8968900198659dc2
ad6a3c2f5fa9ed542a910b9d9aaafb336cfa4399fb4be123f5d94590012ba2a0
b7fa39a9767692ee74840315b88d6d92a72b7a7dfa619aead9b954a39a2a92ee
bde8bfd43ba2dfd032f74d5b84127a5d7e7fc406d16bc1710c95479a6f585d6f
bf0c443dc2d9b706efe7e05218960d3189f91c0bb9d3839ac45de288fd1ca762
c60d2815efaf613db70fffda59a2624cc37e6bec4d3846f9f19e0a5921ca260d
ec5c7271abcef5ffc3995e3221b0af61a2749eabd4914a3cb9fc4b5e9fc02013
efda1329039625b6b665fcc93e49a3f29dead8c49636f9a238ebe4b100301728
f9de31605d388993b1a4fef27f90f3118702ee198ea5630b5663f5beb79d4d49