arkservices.com.sg
Open in
urlscan Pro
203.117.96.166
Malicious Activity!
Public Scan
Effective URL: http://arkservices.com.sg/images/csshtml/absaonline/
Submission: On February 02 via api from FR — Scanned from FR
Summary
This is the only time arkservices.com.sg was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ABSA (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 192.185.217.18 192.185.217.18 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 1 | 203.117.96.166 203.117.96.166 | 4657 (STARHUB-I...) (STARHUB-INTERNET StarHub Ltd) | |
| 3 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: br234-ip04.hostgator.com.br
| solov.art.br |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 1 |
arkservices.com.sg
arkservices.com.sg |
|
| 1 |
solov.art.br
solov.art.br |
357 B |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 3 | 3 |
| Domain | Requested by | |
|---|---|---|
| 1 | arkservices.com.sg | |
| 1 | solov.art.br | |
| 0 | content-accessible Failed |
srcdoc
|
| 3 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| ib.absa.co.za |
| www.absa.co.za |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.com.br.solov.art.br R3 |
2022-12-07 - 2023-03-07 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://arkservices.com.sg/images/csshtml/absaonline/
Frame ID: 0EF16FE75D831FE12C69DE573484E0C5
Requests: 10 HTTP requests in this frame
Frame:
resource://content-accessible/ImageDocument.css
Frame ID: 06ACD9AE136D0ADCCE24B22F05D1EE78
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Absa OnlinePage URL History Show full URLs
- https://solov.art.br/restame.html Page URL
- http://arkservices.com.sg/images/csshtml/absaonline/ Page URL
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title: Registration
Search URL Search Domain Scan URL
Title: How to guide
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Grandmark International Pty Ltd
Search URL Search Domain Scan URL
Title: Explore more ways to do your banking
Search URL Search Domain Scan URL
Title: 2023 rates and fees
Search URL Search Domain Scan URL
Title: Planned Maintenance
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://solov.art.br/restame.html Page URL
- http://arkservices.com.sg/images/csshtml/absaonline/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
restame.html
solov.art.br/ |
604 B 357 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
arkservices.com.sg/images/csshtml/absaonline/ |
447 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
246 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
362 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
43 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
70 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ImageDocument.css
content-accessible/ Frame 06AC |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
643 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ Frame 06AC |
43 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
45 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- content-accessible
- URL
- resource://content-accessible/ImageDocument.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ABSA (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontentvisibilityautostatechange function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
arkservices.com.sg
content-accessible
solov.art.br
content-accessible
192.185.217.18
203.117.96.166
3c243a2d63452b7a8392cdf93e637ec423b3241149831b2082283063d1e34413
620195c7ce8c374b49f3438ad4b3edc1aa33c7ee839d13436f202fc38a55acbb
6a1423dcdc9a531df9d5dfc5a1ea720eec868eda0a56e1580a0c71c69e79b8fe
79fb86c959989a8d2c920e6e4550c396fcee47ec4deda2549b237aca12dd981d
86c3ec119fc6352ca80ccc5b6e2e8fa76c924adecaf33de65da1b892e7b1aa3e
9cb4cfa74675ce403004465dd5f8eaa7c165e24f2ff4e56f3a8d1f53c1617e44
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6b693de4c17c014dad29abe5294359606104283674d45ee8348e9dc731ff540
cb45d428c00e88ea0e73eca797ebb0222173c4bb22a86935a4d94137695a42ef