ekop.pl
Open in
urlscan Pro
194.169.126.4
Malicious Activity!
Public Scan
URL:
http://ekop.pl/components/com_foxcontact/sune/suntrust/index2.htm
Submission: On September 14 via automatic, source openphish
Submission: On September 14 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 10 HTTP transactions.
The main IP is 194.169.126.4, located in
Rybnik, Poland and
belongs to SAFELOCKAS, PL.
The main domain is ekop.pl.
This is the only time ekop.pl was scanned on urlscan.io!
This is the only time ekop.pl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Suntrust (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 194.169.126.4 194.169.126.4 | 61134 (SAFELOCKAS) (SAFELOCKAS) | |
| 9 | 104.108.47.79 104.108.47.79 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 10 | 2 |
9
104.108.47.79
(Amsterdam, Netherlands)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-47-79.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-47-79.deploy.static.akamaitechnologies.com
| www.suntrust.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
suntrust.com
www.suntrust.com |
41 KB |
| 1 |
ekop.pl
ekop.pl |
4 KB |
| 10 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | www.suntrust.com |
ekop.pl
|
| 1 | ekop.pl | |
| 10 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.suntrust.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| suntrust.com Symantec Class 3 Secure Server CA - G4 |
2016-01-25 - 2018-01-25 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://ekop.pl/components/com_foxcontact/sune/suntrust/index2.htm
Frame ID: 17208.1
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
Windows Server
(Operating Systems)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Microsoft ASP.NET
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://www.suntrust.com/imageserver/plumtree/portal/private/pagelayouts/Suntrust/PortletLayout/printer_friendly.html
Title: Return to Standard View ยป
Title: Return to Standard View ยป
Search URL Search Domain Scan URL
URL: https://www.suntrust.com/portal/server.pt?mode=2&uuID={A6EEE149-2019-489F-9C44-57568242F002}
Title: suntrust.com
Title: suntrust.com
Search URL Search Domain Scan URL
URL: https://www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/PDFs/TermsAndConditions.pdf
Title: Online Service Agreement
Title: Online Service Agreement
Search URL Search Domain Scan URL
URL: https://www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/PDFs/Suntrust_Bill_Pay_Guarantee.pdf
Title: Bill Pay Guarantee
Title: Bill Pay Guarantee
Search URL Search Domain Scan URL
URL: https://www.suntrust.com/portal/server.pt/community/privacy_security_fraud/1721
Title: Privacy, Security & Fraud
Title: Privacy, Security & Fraud
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index2.htm
ekop.pl/components/com_foxcontact/sune/suntrust/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
basic.css
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/css/ |
41 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
unauth_edits.css
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/css/ |
594 B 612 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
printerFriendlyLogo.gif
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/images/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
icon_lock.gif
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/images/ |
101 B 119 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
house_ehl.gif
www.suntrust.com/imageserver/Suntrust/prod/Branding/Footers/ |
65 B 83 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
pageBG_770.gif
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/images/ |
129 B 147 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
dataTableHeadBG.gif
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/images/ |
322 B 340 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
suntrustLogo.gif
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/images/ |
25 KB 25 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
button.gif
www.suntrust.com/imageserver/suntrust/prod/experience/PersonalFinance/images/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Suntrust (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ekop.pl
www.suntrust.com
104.108.47.79
194.169.126.4
13aed0678e68491c663cdee589510d2b2c085497c2cde81d50d13c148bb5b853
23a72acb51973e7480c93371f13e8d5f739625bd2f748879a9e377abcf0d86b4
23f6a5fffccd4cc9145035b078071b333fac950defab6ea830b0bb17104b6721
39c92e7847d10d95770762a17492f6847ff78aa9cc44f0f3c451bdf54a88e07d
452266c1af285475915a0d44a511068d10a3d96a3710650019bbe7ef6839dc2e
7363a406eda361fe2751f45bbab1761e76940914b202ec3d45090ed556c8cf89
9f8564b4eb2e46fbe614cd33fdb5fa56465ae4065c18fa8799397f7767e60153
b9d762370fbac42686c50ec99664587e8b5550b1009929d31fd1849810c63e62
bcf10c6045dc3cc7d373840e8ac6ee1030f8e5fa7046f483aec8483b080cd8f2
d034d687bfd018536294a37a8c587620a10ad5db8c5cfc6480cbaf56119ed318