mail.royalclientsecure.com Open in urlscan Pro
176.119.2.148 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
Effective URL:
https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
Submission: On October 30 via api (October 30th 2021, 5:14:56 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 16 HTTP transactions. The main IP is 176.119.2.148, located in Ukraine and belongs to GLP-AS, UA. The main domain is mail.royalclientsecure.com.
TLS certificate: Issued by R3 on October 15th 2021. Valid for: 3 months.

This is the only time mail.royalclientsecure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: RBC (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 17	176.119.2.148 176.119.2.148		58271 (GLP-AS) (GLP-AS)
16	1

17 176.119.2.148 (Ukraine) 1 redirects

ASN58271 (GLP-AS, UA)

mail.royalclientsecure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	royalclientsecure.com 1 redirects mail.royalclientsecure.com	85 KB
16	1

	Domain	Requested by
17	mail.royalclientsecure.com	1 redirects mail.royalclientsecure.com
16	1

This site contains no links.

Subject Issuer	Validity	Valid
royalclientsecure.com R3	`2021-10-15` - `2022-01-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
Frame ID: D539EF415D9E5F5B702E3521B6FA07D7
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RBC Royal Bank - Sign In to Online Banking

Page URL History Show full URLs

http://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a... HTTP 302
https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a... Page URL

Page Statistics

16
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

84 kB
Transfer

80 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9 HTTP 302
https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
mail.royalclientsecure.com/auth/RoyalRBC/
Redirect Chain

http://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

26 KB
26 KB

618ms
130ms

Document
text/html

176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) / PHP/5.3.3

Resource Hash

b090cc889ca7b79d887990d4ede8e0499881060dc87f4d2b4d8511ca99067b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Server: Apache/2.2.22 (@RELEASE@)
Strict-Transport-Security: max-age=31536000; preload
X-Powered-By: PHP/5.3.3
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

Redirect headers

Date: Sat, 30 Oct 2021 17:14:50 GMT
Server: Apache/2.2.22 (@RELEASE@)
Location: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
Content-Length: 415
Connection: close
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK main.css
mail.royalclientsecure.com/auth/RoyalRBC/ 31 KB
31 KB 173ms
59ms Stylesheet
text/css 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

7ddb3f4623a9d0aea62cbfb45bd4aab80bb3f0f810da35877f00241343520e44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3f-7c58-5ce674ad3943c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 31832

GET
H/1.1 200
OK logo_rbc-royalbank-white-en.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 5 KB
6 KB 174ms
58ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/logo_rbc-royalbank-white-en.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

4ad25cca003756c56d16dbc0b68bc7bf4449a33aeb046eb4d0552990a2cfdb9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c35-1562-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 5474

GET
H/1.1 200
OK search-signin.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 508 B
824 B 173ms
58ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/search-signin.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

6a4cefca46eb1ca796a81fd90f6c8a5c5dc4a8526bde1a9634a833b47221bb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3d-1fc-5ce674ad39054"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 508

GET
H/1.1 200
OK canada.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 836 B
1 KB 173ms
58ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/canada.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

78920a7468b87496f5d9d3e5ec2bae5ba070c741c6d71eb1e7b3214a92bb353c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c39-344-5ce674ad38c6c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 836

GET
H/1.1 200
OK logo-rbc-shield.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 5 KB
5 KB 180ms
63ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/logo-rbc-shield.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

65810b2abb5357e9d521f65bc4270894f90cb4f531b9d48bd202e3562920bfde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c0e-143d-5ce674ad374fb"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 5181

GET
H/1.1 200
OK close-blue.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 440 B
756 B 181ms
63ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/close-blue.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

f072f948a69fa01073e7561ffc54019409436fff0deee7c868ca670b2f4b849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c1e-1b8-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 440

GET
H/1.1 200
OK tooltipPeak.png
mail.royalclientsecure.com/auth/RoyalRBC/ 259 B
571 B 179ms
57ms Image
image/png 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/tooltipPeak.png

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

5ebd4e99e10ea98455582e5949a0d1bda24645b23971cd3e322eeea55f9b1c48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c34-103-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 259

GET
H/1.1 200
OK to-top-white.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 443 B
759 B 178ms
57ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/to-top-white.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

a51aaa34a0ed0bbfa7cd4cbfb5060f0c0a277825702f9f87ec921bb1deb0022d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/?6f5eed4e647ca26c0a5a4508d4199fc7&dispatch=b339334defa69d5cc0a4b1d1cfbadefe4f7ce3c9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:51 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c37-1bb-5ce674ad38c6c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 443

GET
H/1.1 200
OK triangle-down-white.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 398 B
714 B 175ms
59ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/triangle-down-white.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

657af7581552bd71f795ce717ae163c62507c7fc12dfefae0cf4ed4811f3f2eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:52 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c33-18e-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 398

GET
H/1.1 200
OK chevron-right-white.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 427 B
743 B 346ms
58ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/chevron-right-white.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

1c323c6269a284f42a11ab70483a7ef20003570cde175735da4b1e2b0d12b5a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:52 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c16-1ab-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 427

GET
H/1.1 200
OK angle-right-small.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 2 KB
2 KB 513ms
56ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/angle-right-small.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

169b2c80c3cf9bba841ccd21f0a32cd56cf82b55917b228f0d9354fa5e312479

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:52 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3a-89e-5ce674ad38c6c"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2206

GET
H/1.1 200
OK lock-small.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 2 KB
2 KB 1239ms
57ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/lock-small.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

208bd303e33d60639dbebdf5a93db4f0fb2999bda5c34bb8408679bbb8243197

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:53 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c18-752-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 1874

GET
H/1.1 200
OK chevron.png
mail.royalclientsecure.com/auth/RoyalRBC/ 149 B
460 B 147ms
59ms Image
image/png 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/chevron.png

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

463c807898d95421f1d1b08aa1cf30873aa2cfeec128f65946107a2d27700f5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:52 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c12-95-5ce674ad378e3"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 149

GET
H/1.1 200
OK external-link-small.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 2 KB
3 KB 145ms
58ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/external-link-small.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

776c50dabbcf9967aef068d7ffa38e199a2b9a7e87697750a22ea70344072f32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:52 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c3c-9b1-5ce674ad39054"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2481

GET
H/1.1 200
OK external-link-small-blue.svg
mail.royalclientsecure.com/auth/RoyalRBC/ 2 KB
3 KB 144ms
57ms Image
image/svg+xml 176.119.2.148
GLP-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mail.royalclientsecure.com/auth/RoyalRBC/external-link-small-blue.svg

Requested by

Host: mail.royalclientsecure.com
URL: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

176.119.2.148 , Ukraine, ASN58271 (GLP-AS, UA),

Reverse DNS

Software

Apache/2.2.22 (@RELEASE@) /

Resource Hash

8573659e2191285fd760e060f497bcb52a87936f8806251471dbefae13795ca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mail.royalclientsecure.com/auth/RoyalRBC/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sat, 30 Oct 2021 17:14:52 GMT
Last-Modified: Fri, 15 Oct 2021 17:11:55 GMT
Server: Apache/2.2.22 (@RELEASE@)
ETag: "141c32-98e-5ce674ad38883"
Strict-Transport-Security: max-age=31536000; preload
Content-Type: image/svg+xml
Connection: close
Accept-Ranges: bytes
Content-Length: 2446

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: RBC (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail.royalclientsecure.com
176.119.2.148
169b2c80c3cf9bba841ccd21f0a32cd56cf82b55917b228f0d9354fa5e312479
1c323c6269a284f42a11ab70483a7ef20003570cde175735da4b1e2b0d12b5a7
208bd303e33d60639dbebdf5a93db4f0fb2999bda5c34bb8408679bbb8243197
463c807898d95421f1d1b08aa1cf30873aa2cfeec128f65946107a2d27700f5b
4ad25cca003756c56d16dbc0b68bc7bf4449a33aeb046eb4d0552990a2cfdb9a
5ebd4e99e10ea98455582e5949a0d1bda24645b23971cd3e322eeea55f9b1c48
657af7581552bd71f795ce717ae163c62507c7fc12dfefae0cf4ed4811f3f2eb
65810b2abb5357e9d521f65bc4270894f90cb4f531b9d48bd202e3562920bfde
6a4cefca46eb1ca796a81fd90f6c8a5c5dc4a8526bde1a9634a833b47221bb3c
776c50dabbcf9967aef068d7ffa38e199a2b9a7e87697750a22ea70344072f32
78920a7468b87496f5d9d3e5ec2bae5ba070c741c6d71eb1e7b3214a92bb353c
7ddb3f4623a9d0aea62cbfb45bd4aab80bb3f0f810da35877f00241343520e44
8573659e2191285fd760e060f497bcb52a87936f8806251471dbefae13795ca0
a51aaa34a0ed0bbfa7cd4cbfb5060f0c0a277825702f9f87ec921bb1deb0022d
b090cc889ca7b79d887990d4ede8e0499881060dc87f4d2b4d8511ca99067b4b
f072f948a69fa01073e7561ffc54019409436fff0deee7c868ca670b2f4b849b

mail.royalclientsecure.com Open in urlscan Pro 176.119.2.148 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

84 kBTransfer

80 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

mail.royalclientsecure.com Open in urlscan Pro
176.119.2.148 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

84 kB
Transfer

80 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!