cavalierravishing.com
Open in
urlscan Pro
18.156.73.15
Malicious Activity!
Public Scan
URL:
https://cavalierravishing.com/rc.html
Submission: On June 16 via manual from IN
Submission: On June 16 via manual from IN
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 18.156.73.15, located in
United States and
belongs to AMAZON-02, US.
The main domain is cavalierravishing.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 14th 2020. Valid for: 3 months.
This is the only time cavalierravishing.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 14th 2020. Valid for: 3 months.
This is the only time cavalierravishing.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commonwealth Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 18.156.73.15 18.156.73.15 | 16509 (AMAZON-02) (AMAZON-02) | |
| 4 | 24.244.156.42 24.244.156.42 | 15146 (CABLEBAHAMAS) (CABLEBAHAMAS) | |
| 11 | 2 |
7
18.156.73.15
(United States)
ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-73-15.eu-central-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-73-15.eu-central-1.compute.amazonaws.com
| cavalierravishing.com |
4
24.244.156.42
(Nassau, Bahamas)
ASN15146 (CABLEBAHAMAS, BS)
PTR: cbleib.combankltd.com
ASN15146 (CABLEBAHAMAS, BS)
PTR: cbleib.combankltd.com
| cbleib.combankltd.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
cavalierravishing.com
cavalierravishing.com |
832 KB |
| 4 |
combankltd.com
cbleib.combankltd.com |
13 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | cavalierravishing.com |
cavalierravishing.com
|
| 4 | cbleib.combankltd.com | |
| 11 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| play.google.com |
| itunes.apple.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cavalierravishing.com cPanel, Inc. Certification Authority |
2020-06-14 - 2020-09-12 |
3 months | crt.sh |
| cbleib.combankltd.com DigiCert SHA2 Extended Validation Server CA |
2020-06-05 - 2022-06-29 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://cavalierravishing.com/rc.html
Frame ID: 2D1367D387E64A08D27E497DB07599C4
Requests: 11 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
URL: https://play.google.com/store/apps/details?id=com.combankltd.direct
Title:
Title:
Search URL Search Domain Scan URL
URL: https://itunes.apple.com/us/app/id1438207631
Title:
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
rc.html
cavalierravishing.com/ |
18 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendor.css
cavalierravishing.com/files/ |
209 KB 209 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
omnia.css
cavalierravishing.com/files/ |
550 KB 550 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
cavalierravishing.com/files/ |
55 KB 55 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
RxZJdnzeo3R5zSexge8UUT8E0i7KZn-EPnyo3HZu7kw.woff
cavalierravishing.com/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Hgo13k-tfSpn0qi1SFdUfT8E0i7KZn-EPnyo3HZu7kw.woff
cavalierravishing.com/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2UX7WLTfW3W8TclTUvlFyQ.woff
cavalierravishing.com/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
available-in-googleplay.png
cbleib.combankltd.com/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
available-in-appstore.png
cbleib.combankltd.com/img/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
phone@2x.png
cbleib.combankltd.com/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
envelope@2x.png
cbleib.combankltd.com/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commonwealth Bank (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cavalierravishing.com
cbleib.combankltd.com
18.156.73.15
24.244.156.42
3801fd9afb62498f75f381dbff951f3b4b9d3bfaeefaba68b93ca7ffce4b5ac9
4fb6515540e7585a6d7b1b70915981ad528bdccd4beef366d33785d61abaa7a2
6d2f45997b5a9cadc60c13beedbbf843d2b1718d47f813d915384e44f26a05ef
8fb45fc08db7c6cf27900a5ef08eed4c03ec2a8362ccea2d818793a1e01765f8
a3b060f50471b8d5141aa40f89b07c30986a985a47b403e511a9244753a1437e
af2e512f2c734d26e24589b243994f37791e43f8cc02c4f70b245c4b284c1fc0
c24ed5aca62c867c12e5bab77658a7ffe58c3811c91fe63dc0da6eaa81c9bc00
c2e6a80ec2cff8a14941fed24062c4e0c15bec16c38b0d1b736922cc70c1062c