xprescanpost.com Open in urlscan Pro
91.212.166.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://xprescanpost.com/views/choice/bmo/start.php
Submission: On August 03 via api (August 3rd 2024, 10:42:05 pm UTC) from BE — Scanned from US

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 91.212.166.16, located in Russian Federation and belongs to PROTON66, RU. The main domain is xprescanpost.com.
TLS certificate: Issued by R11 on July 31st 2024. Valid for: 3 months.

This is the only time xprescanpost.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of Montreal (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	91.212.166.16 91.212.166.16	198953 (PROTON66) (PROTON66)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
3	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	3

10 91.212.166.16 (Russian Federation)

ASN198953 (PROTON66, RU)

xprescanpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	xprescanpost.com xprescanpost.com	316 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	27 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1211	31 KB
14	3

	Domain	Requested by
10	xprescanpost.com	xprescanpost.com code.jquery.com
3	cdnjs.cloudflare.com	xprescanpost.com
1	code.jquery.com	xprescanpost.com
14	3

This site contains no links.

Subject Issuer	Validity	Valid
quebecdepotenligne.com R11	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xprescanpost.com/views/choice/bmo/start.php
Frame ID: A5C4CBF1D7EA6CF4B9243213BD7E3014
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

29 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

374 kB
Transfer

764 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request start.php Show response
xprescanpost.com/views/choice/bmo/ 270 KB
43 KB 728ms
381ms Document
text/html 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to

Full URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 68f3757670b3fbcba05b3f123f185ae3301bd9a15c38e33aab5a18bdf5fb44d7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sat, 03 Aug 2024 22:41:59 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 139ms
31ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://xprescanpost.com/
Origin: https://xprescanpost.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 22:42:00 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1152660
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-mia-kmia1760058-MIA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1722724920.247392,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 25, 244608

GET
H3 200 all.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/ 71 KB
11 KB 77ms
41ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.css

Requested by

Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e628a2b756298c0c23863d3c759a9ff921a8a9e8158c672e473212dcfb8a3d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://xprescanpost.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 22:42:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 952201
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10700
last-modified: Wed, 15 Jul 2020 18:15:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f0f47d3-11d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UYDOeyE2vh%2FOE%2BgLRU%2B39q5uC8dVAXH1mKImecMoyHdYbs9%2Fy9XWCSNShACOH4eYQ9HnCfAT1gsWgXMZgX%2BmhY7p8SWvj6qVAynxf23rkLsSKxwE0WJ3B9KwU2TQx01437jyzxGS"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ad9d17f09102888-MIA
expires: Thu, 24 Jul 2025 22:42:00 GMT

GET
H/1.1 200
OK bmo-logo-white.svg
xprescanpost.com/views/choice/bmo/assets/files/ 3 KB
3 KB 172ms
170ms Image
image/svg+xml 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xprescanpost.com/views/choice/bmo/assets/files/bmo-logo-white.svg
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: bb7af830300442e4ff713146efe19833948f4a95882d0d6d4f811d7f5bdd4772

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:00 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-b73"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2931

GET
H/1.1 200
OK loading.gif
xprescanpost.com/views/choice/bmo/assets/ 163 KB
163 KB 679ms
340ms Image
image/gif 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xprescanpost.com/views/choice/bmo/assets/loading.gif
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e07efed33aec4356ba72efae1eea9fbe1e922bd270ddbd0dd1a028b5a6db4140

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:00 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-28a42"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 166466

GET
H/1.1 200
OK 1.png
xprescanpost.com/views/choice/bmo/assets/files/ 625 B
872 B 424ms
170ms Image
image/png 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xprescanpost.com/views/choice/bmo/assets/files/1.png
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: b56ae114bdf5ff5bdb2fdf6ee45c1ceb5972e2995f9a537eb4d4fa6f1c2c511e

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:00 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-271"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 625

GET
H/1.1 200
OK 2.png
xprescanpost.com/views/choice/bmo/assets/files/ 819 B
1 KB 509ms
171ms Image
image/png 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xprescanpost.com/views/choice/bmo/assets/files/2.png
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 9f0915b5de5d53754af24f154e9aa38fac828b534c3e283ca6191b6e9c8f3125

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:00 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-333"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 819

GET
H3 200 imask.min.js Show response
cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/ 45 KB
11 KB 41ms
40ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js

Requested by

Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://xprescanpost.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 22:42:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1416510
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10899
last-modified: Mon, 04 May 2020 16:11:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e9f-b217"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MuylJPzvvlr0Qq%2BDvHZO%2BWOSoSho5qIgWmNB9hGGOzvmeNEG9vcQjEOC6pCkaPFSxS3snV8FA08kKHIQNrL2u5%2BIeLpIj1owZ4kMcBnlAHD9IKIJl90838KzYDumZ%2FpC%2F3QK%2FUog"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ad9d17fd9f42888-MIA
expires: Thu, 24 Jul 2025 22:42:00 GMT

GET
H3 200 jquery.mask.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ 20 KB
5 KB 40ms
40ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js

Requested by

Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://xprescanpost.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 22:42:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 56492
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4517
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-4e98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FKAro0tbyV37SQg6BMt2S%2BYJ0zHffDCZ6GlbIrwn56UMDDpVFAxwftLNWoEP%2FUWYAKcgcBxdfVsnqVBjG69yjLeSACDqDlxVW7qZl3jtzyhitbj8tReBqRJZTazrkAbuR9Djr3LE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ad9d17fd9f82888-MIA
expires: Thu, 24 Jul 2025 22:42:00 GMT

GET
H/1.1 200
OK cc.js Show response
xprescanpost.com/views/choice/bmo/levanon/js/ 60 KB
60 KB 680ms
340ms Script
application/javascript 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to

Full URL: https://xprescanpost.com/views/choice/bmo/levanon/js/cc.js
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f38f4c666dae88e46882f4d5a572a9e919a32d2e14211b3af28f210b1f7fd404

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:00 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-ef41"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 61249

POST
H/1.1 200
OK updateVisitor.php Show response
xprescanpost.com/app/php/ 349 B
676 B 254ms
241ms XHR
text/html 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to

Full URL: https://xprescanpost.com/app/php/updateVisitor.php
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: d1ae6ca5c3ce2f65d995db825a85b3dccc9bf7135f05bfa4426ac9fa0183fe9f

Request headers

Accept: */*
Referer: https://xprescanpost.com/views/choice/bmo/start.php
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Sat, 03 Aug 2024 22:42:00 GMT
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK header-background.3cfd406909d4684e1416d67e8158afc5.png
xprescanpost.com/views/choice/bmo/assets/ 5 KB
5 KB 504ms
171ms Image
image/png 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xprescanpost.com/views/choice/bmo/assets/header-background.3cfd406909d4684e1416d67e8158afc5.png
Requested by: Host: xprescanpost.com
URL: https://xprescanpost.com/views/choice/bmo/start.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 4e95d8e2a43e43305fbff1e490ceb4093f8f05b971ff6100417c3d5449c94cb2

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:00 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-1311"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4881

POST
H/1.1 200
OK check_activity.php Show response
xprescanpost.com/app/php/ 349 B
676 B 225ms
225ms XHR
text/html 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to

Full URL: https://xprescanpost.com/app/php/check_activity.php
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: d1ae6ca5c3ce2f65d995db825a85b3dccc9bf7135f05bfa4426ac9fa0183fe9f

Request headers

Accept: */*
Referer: https://xprescanpost.com/views/choice/bmo/start.php
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Sat, 03 Aug 2024 22:42:01 GMT
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK favicon.ico
xprescanpost.com/views/choice/bmo/assets/ 39 KB
40 KB 172ms
171ms Other
image/x-icon 91.212.166.16
PROTON66

General

Check archive.org

Show headers Download Go to

Full URL: https://xprescanpost.com/views/choice/bmo/assets/favicon.ico?v=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.212.166.16 , Russian Federation, ASN198953 (PROTON66, RU),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 97430e7b28b7b1882e1a316323d3ac9d6871de5038ad36dd3fd7900a87716459

Request headers

Referer: https://xprescanpost.com/views/choice/bmo/start.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Sat, 03 Aug 2024 22:42:01 GMT
Last-Modified: Tue, 30 Jul 2024 22:01:50 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "66a962ce-9da6"
Content-Type: image/x-icon
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 40358

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of Montreal (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			xprescanpost.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: vjbp1cqncl3ei50340r5nasiuh

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://xprescanpost.com/views/choice/bmo/start.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
xprescanpost.com
104.17.25.14
2a04:4e42:400::649
91.212.166.16
1e628a2b756298c0c23863d3c759a9ff921a8a9e8158c672e473212dcfb8a3d1
4e95d8e2a43e43305fbff1e490ceb4093f8f05b971ff6100417c3d5449c94cb2
68f3757670b3fbcba05b3f123f185ae3301bd9a15c38e33aab5a18bdf5fb44d7
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
97430e7b28b7b1882e1a316323d3ac9d6871de5038ad36dd3fd7900a87716459
9f0915b5de5d53754af24f154e9aa38fac828b534c3e283ca6191b6e9c8f3125
b56ae114bdf5ff5bdb2fdf6ee45c1ceb5972e2995f9a537eb4d4fa6f1c2c511e
bb7af830300442e4ff713146efe19833948f4a95882d0d6d4f811d7f5bdd4772
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
d1ae6ca5c3ce2f65d995db825a85b3dccc9bf7135f05bfa4426ac9fa0183fe9f
e07efed33aec4356ba72efae1eea9fbe1e922bd270ddbd0dd1a028b5a6db4140
f38f4c666dae88e46882f4d5a572a9e919a32d2e14211b3af28f210b1f7fd404
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

xprescanpost.com Open in urlscan Pro 91.212.166.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

29 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

374 kBTransfer

764 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

xprescanpost.com Open in urlscan Pro
91.212.166.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

29 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

374 kB
Transfer

764 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!