00001062.com Open in urlscan Pro
35.203.94.219  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request confirm.html Show response 00001062.com/banks/Scotia/	9 KB 3 KB	479ms 228ms	Document text/html	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 9e490621a6430fe5b21e756d6599dce439d3703fa17349fae5e6246eb043e7ee Request headers :method GET :authority 00001062.com :scheme https :path /banks/Scotia/confirm.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server nginx date Sun, 28 Mar 2021 13:47:14 GMT content-type text/html vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie last-modified Sat, 27 Mar 2021 23:08:47 GMT x-powered-by WP Engine x-cacheable SHORT cache-control max-age=600, must-revalidate etag W/"2254-5be8cbb15def3-gzip" x-cache HIT: 4 x-cache-group normal content-encoding br
GET H2	200	id Show response 00001062.com/banks/Scotia/confirm_files/	251 B 497 B	170ms 169ms	Script text/plain	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm_files/id Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 2b562d7dd5bc11d13de8007a1230cc479b4c19f1000e437521de554d9f85e0ae Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:14 GMT last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx x-cacheable SHORT x-powered-by WP Engine etag "fb-5be8cbc5b955f" vary Accept-Encoding,Cookie x-cache HIT: 3 cache-control max-age=600, must-revalidate accept-ranges bytes content-length 251 x-cache-group normal
GET H2	200	id_002 Show response 00001062.com/banks/Scotia/confirm_files/	255 B 500 B	422ms 421ms	Script text/plain	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm_files/id_002 Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash f176b48c4da7f64235edb03f4e0805abd751a34466e12ee7b1512f4c441b72bd Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:14 GMT last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx x-cacheable SHORT x-powered-by WP Engine etag "ff-5be8cbc5b667e" vary Accept-Encoding,Cookie x-cache HIT: 3 cache-control max-age=600, must-revalidate accept-ranges bytes content-length 255 x-cache-group normal
GET H2	200	css.css 00001062.com/banks/Scotia/confirm_files/	236 KB 34 KB	170ms 169ms	Stylesheet text/css	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm_files/css.css Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / Resource Hash c54ab51f01b9b490939b339d65d34601798c166a252628eefc9854ecffa31f5f Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:14 GMT content-encoding br last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx etag W/"605fbb14-3af08" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	scripts.js Show response 00001062.com/banks/Scotia/confirm_files/	779 KB 170 KB	229ms 229ms	Script application/javascript	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm_files/scripts.js Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / Resource Hash b1b38e3dfbd776e583be8667c46e4a6a1afa21b0f8612670ba58c15001a7b019 Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:14 GMT content-encoding br last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx etag W/"605fbb14-c2bae" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	components.js Show response 00001062.com/banks/Scotia/confirm_files/	237 KB 31 KB	141ms 140ms	Script application/javascript	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm_files/components.js Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / Resource Hash a4fe358e369339f40c2dadae1f52e2be798060cc2c9ce318c89ce69e6446324f Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:14 GMT content-encoding br last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx etag W/"605fbb14-3b372" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	logo.svg 00001062.com/banks/Scotia/confirm_files/	12 KB 5 KB	207ms 206ms	Image image/svg+xml	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://00001062.com/banks/Scotia/confirm_files/logo.svg Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / Resource Hash 64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1 Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:15 GMT content-encoding br last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx etag W/"605fbb14-30d0" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	async.js Show response 00001062.com/banks/Scotia/confirm_files/	54 KB 15 KB	142ms 141ms	Script application/javascript	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/confirm_files/async.js Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / Resource Hash 1474ec7e472fa2d738c21fb9d88fa3d08d5a2d78781adba5744fc8f4c1eacf18 Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:47:14 GMT content-encoding br last-modified Sat, 27 Mar 2021 23:09:08 GMT server nginx etag W/"605fbb14-d76b" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2 fonts.gstatic.com/s/lato/v11/	16 KB 16 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v11/MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2 Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm_files/css.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://00001062.com Referer https://00001062.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 04:00:15 GMT x-content-type-options nosniff last-modified Mon, 06 Oct 2014 20:38:14 GMT server sffe age 208019 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16436 x-xss-protection 0 expires Sat, 26 Mar 2022 04:00:15 GMT
GET H2	200	translation.json Show response 00001062.com/banks/Scotia/locales/en-US/	84 KB 15 KB	255ms 254ms	XHR text/html	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/locales/en-US/translation.json?_=1616939235039 Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm_files/scripts.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 0c1a9d0baf4b7f234584bc0d0e47ab6c434d5fa6854754ba4c2244fd9dac271e Request headers accept */* Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 content-type application/x-www-form-urlencoded;charset=UTF-8 Response headers date Sun, 28 Mar 2021 13:47:15 GMT content-encoding br x-cacheable SHORT server nginx x-powered-by WP Engine vary Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie x-cache MISS content-type text/html; charset=UTF-8 cache-control max-age=600, must-revalidate x-cache-group normal
GET H2	200	translation.json Show response 00001062.com/banks/Scotia/locales/en/	84 KB 15 KB	260ms 259ms	XHR text/html	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/banks/Scotia/locales/en/translation.json?_=1616939235039 Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm_files/scripts.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 0c1a9d0baf4b7f234584bc0d0e47ab6c434d5fa6854754ba4c2244fd9dac271e Request headers accept */* Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 content-type application/x-www-form-urlencoded;charset=UTF-8 Response headers date Sun, 28 Mar 2021 13:47:15 GMT content-encoding br x-cacheable SHORT server nginx x-powered-by WP Engine vary Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie x-cache MISS content-type text/html; charset=UTF-8 cache-control max-age=600, must-revalidate x-cache-group normal
POST H2	200	_data Show response 00001062.com/_bm/	84 KB 15 KB	223ms 223ms	XHR text/html	35.203.94.219 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://00001062.com/_bm/_data Requested by Host: 00001062.com URL: https://00001062.com/banks/Scotia/confirm_files/async.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.203.94.219 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS 219.94.203.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 0c1a9d0baf4b7f234584bc0d0e47ab6c434d5fa6854754ba4c2244fd9dac271e Request headers Referer https://00001062.com/banks/Scotia/confirm.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-type application/json Response headers date Sun, 28 Mar 2021 13:47:15 GMT content-encoding gzip server nginx x-powered-by WP Engine content-length 15453 vary Accept-Encoding content-type text/html; charset=UTF-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| requirejs function| require function| define function| $ function| jQuery object| html5 object| Modernizr object| Foundation object| usedVer object| BnsTmxLoader object| _cf object| BankingJS string| feature object| _ac object| cf string| _sd_trace

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://00001062.com/banks/Scotia/confirm_files/scripts.js(Line 69) Message: Can not parse JSON. URL: locales/en-US/translation.json?_=1616939235039
console-api	error	URL: https://00001062.com/banks/Scotia/confirm_files/scripts.js(Line 69) Message: Can not parse JSON. URL: locales/en/translation.json?_=1616939235039

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

00001062.com
fonts.gstatic.com
2a00:1450:4001:82a::2003
35.203.94.219
0c1a9d0baf4b7f234584bc0d0e47ab6c434d5fa6854754ba4c2244fd9dac271e
1474ec7e472fa2d738c21fb9d88fa3d08d5a2d78781adba5744fc8f4c1eacf18
2b562d7dd5bc11d13de8007a1230cc479b4c19f1000e437521de554d9f85e0ae
64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1
9e490621a6430fe5b21e756d6599dce439d3703fa17349fae5e6246eb043e7ee
a4fe358e369339f40c2dadae1f52e2be798060cc2c9ce318c89ce69e6446324f
b1b38e3dfbd776e583be8667c46e4a6a1afa21b0f8612670ba58c15001a7b019
b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f
c54ab51f01b9b490939b339d65d34601798c166a252628eefc9854ecffa31f5f
f176b48c4da7f64235edb03f4e0805abd751a34466e12ee7b1512f4c441b72bd