a2plvcpnl216602.prod.iad2.secureserver.net
Open in
urlscan Pro
148.72.1.111
Malicious Activity!
Public Scan
Submission: On May 11 via manual from GB
Summary
TLS certificate: Issued by Starfield Secure Certificate Authorit... on January 14th 2020. Valid for: 2 years.
This is the only time a2plvcpnl216602.prod.iad2.secureserver.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: GTBank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 148.72.1.111 148.72.1.111 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
8 | 41.203.112.143 41.203.112.143 | 37001 (GTB-AS) (GTB-AS) | |
9 | 2 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-148-72-1-111.ip.secureserver.net
a2plvcpnl216602.prod.iad2.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
gtbank.com
ibank.gtbank.com |
17 KB |
1 |
secureserver.net
a2plvcpnl216602.prod.iad2.secureserver.net |
4 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
8 | ibank.gtbank.com |
a2plvcpnl216602.prod.iad2.secureserver.net
|
1 | a2plvcpnl216602.prod.iad2.secureserver.net | |
9 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
ibank.gtbank.com |
www.gtbank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.prod.iad2.secureserver.net Starfield Secure Certificate Authority - G2 |
2020-01-14 - 2022-01-14 |
2 years | crt.sh |
ibank.gtbank.com DigiCert SHA2 Extended Validation Server CA |
2019-12-27 - 2022-02-01 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://a2plvcpnl216602.prod.iad2.secureserver.net/~oj6uhj7xdvaj/jandartravel.com/wordpress/wp-content/plugins/ubh/gtcard3/gtb/gtb/gt/gt/continue.php
Frame ID: F34BB3D1D4BD9EBAB343F8D17CD0764F
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
FrontPage (Editors) ExpandDetected patterns
- meta generator /Microsoft FrontPage(?:\s((?:Express )?[\d.]+))?/i
- meta ProgId /^FrontPage\./i
PHP (Programming Languages) Expand
Detected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
47 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: CLICK TO VISIT
Search URL Search Domain Scan URL
Title: READ MORE
Search URL Search Domain Scan URL
Title: GET YOURS
Search URL Search Domain Scan URL
Title: GTBANK.COM
Search URL Search Domain Scan URL
Title: TERMS & CONDITIONS
Search URL Search Domain Scan URL
Title: WHISTLE BLOWER
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
continue.php
a2plvcpnl216602.prod.iad2.secureserver.net/~oj6uhj7xdvaj/jandartravel.com/wordpress/wp-content/plugins/ubh/gtcard3/gtb/gtb/gt/gt/ |
70 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
ibank.gtbank.com/ibank3/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibtxt.png
ibank.gtbank.com/ibank3/img/ |
826 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
footbg.png
ibank.gtbank.com/ibank3/img/ |
331 B 891 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info.png
ibank.gtbank.com/ibank3/img/ |
909 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gradbg.png
ibank.gtbank.com/ibank3/img/ |
183 B 743 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apps.png
ibank.gtbank.com/ibank3/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shield.png
ibank.gtbank.com/ibank3/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.png
ibank.gtbank.com/ibank3/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: GTBank (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a2plvcpnl216602.prod.iad2.secureserver.net
ibank.gtbank.com
148.72.1.111
41.203.112.143
2e4c633aec6812de304935dc93b8dfa3fa16176780832d362cc6340ecc832b84
53920bb8e98d002e6b57db8a516efe8835c6bda241020cc64ffad5ef4c5c28f9
736f03dc62c4d15eb44d93effa1b31bedfc4ad84db8f95d6e33eef2a8196b558
92027ff441180d1fe078e47cc39d2346ca895df87c3c928eb03323a5047e8794
9a7ca670add876603d9cfa2e106953f42d420ee481ff01ebabe686e97d902539
a6bcd752be34b36a77239beeb597fdb11f9e07d5be127ee523f03520d52d3ad2
aaeaf8ebf5b61080b3e1f7e675c85a42e051d4edb6183efb8968900198659dc2
b7fa39a9767692ee74840315b88d6d92a72b7a7dfa619aead9b954a39a2a92ee
cf6001507e4492235108f3cbc185d378be407cbada5bf6d556a110ad56295ecd