rbverifyportal.com Open in urlscan Pro
92.87.6.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://rbverifyportal.com/
Effective URL:
http://rbverifyportal.com/login.php
Submission: On August 18 via manual (August 18th 2022, 6:11:10 am UTC) from RO — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 92.87.6.52, located in Iasi, Romania and belongs to RTD Bucharest, Romania, RO. The main domain is rbverifyportal.com.

This is the only time rbverifyportal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Randolph Brooks Federal Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 9	92.87.6.52 92.87.6.52	9050 (RTD Bucha...) (RTD Bucharest)
2	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
10	2

9 92.87.6.52 (Iasi, Romania) 1 redirects

ASN9050 (RTD Bucharest, Romania, RO)

rbverifyportal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	rbverifyportal.com 1 redirects rbverifyportal.com	38 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54 ajax.googleapis.com — Cisco Umbrella Rank: 286	32 KB
10	2

	Domain	Requested by
9	rbverifyportal.com	1 redirects rbverifyportal.com
1	ajax.googleapis.com	rbverifyportal.com
1	fonts.googleapis.com	rbverifyportal.com
10	3

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://rbverifyportal.com/login.php
Frame ID: 3C3987772FBCC0A6D26DC71463E82CEB
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RBFCU Login

Page URL History Show full URLs

http://rbverifyportal.com/ HTTP 302
http://rbverifyportal.com/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

70 kB
Transfer

211 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rbverifyportal.com/ HTTP 302
http://rbverifyportal.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.php Show response
rbverifyportal.com/
Redirect Chain

http://rbverifyportal.com/
http://rbverifyportal.com/login.php

4 KB
2 KB

394ms
391ms

Document
text/html

92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to

Full URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: / PHP/7.2.34
Resource Hash: 0068843898265344ea1cf5dccdc4134ba29b548475c4ca6ab03935316aaa8cfa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1429
content-type: text/html; charset=UTF-8
date: Thu, 18 Aug 2022 06:11:04 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.2.34

Redirect headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 Aug 2022 06:11:04 GMT
location: ./login.php
vary: User-Agent
x-powered-by: PHP/7.2.34

GET
H/1.1 200
OK style.css
rbverifyportal.com/assets/css/ 5 KB
2 KB 48ms
47ms Stylesheet
text/css 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to

Full URL: http://rbverifyportal.com/assets/css/style.css
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: f370b16182dc957112446e01a41c2583678502a40c99c3c81c22c32c13cd1af7

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
content-encoding: gzip
last-modified: Sun, 26 Jun 2022 19:07:26 GMT
etag: "155d-62b8ae6e-6910a90e6ec60bf1;gz"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 1762
expires: Thu, 25 Aug 2022 06:11:04 GMT

GET
H2 200 icon
fonts.googleapis.com/ 569 B
869 B 46ms
17ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

13b6581e5665a9e516751b0326354eaeb7853be7cbe4153adc6cad59b683e889

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 18 Aug 2022 06:11:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 18 Aug 2022 06:11:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Aug 2022 06:11:04 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 36ms
7ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Fri, 12 Aug 2022 15:28:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484973
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Aug 2023 15:28:11 GMT

GET
H/1.1 200
OK logo.svg
rbverifyportal.com/assets/ 5 KB
3 KB 84ms
55ms Image
image/svg+xml 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rbverifyportal.com/assets/logo.svg
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: 09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
content-encoding: gzip
last-modified: Mon, 20 Jun 2022 05:09:14 GMT
etag: "1507-62b000fa-47d47654c902b88f;gz"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 2634
expires: Thu, 25 Aug 2022 06:11:04 GMT

GET
H/1.1 200
OK white.png
rbverifyportal.com/assets/ 105 B
469 B 83ms
45ms Image
image/png 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rbverifyportal.com/assets/white.png
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: 17c72060acba211314dc6fb56a7493671ca538778310cab3afcc97cd53bd454a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
last-modified: Wed, 22 Jun 2022 01:00:22 GMT
etag: "69-62b269a6-f5c927975b5b8a63;;;"
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 105
expires: Thu, 25 Aug 2022 06:11:04 GMT

GET
H/1.1 200
OK cross.svg
rbverifyportal.com/assets/ 1 KB
1001 B 99ms
45ms Image
image/svg+xml 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rbverifyportal.com/assets/cross.svg
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: 3e79a7820b1c466e26cee45a9f4a33fd690a769d1e61af5a8df095e49c5057b4

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
content-encoding: gzip
last-modified: Wed, 22 Jun 2022 00:36:18 GMT
etag: "585-62b26402-13ddaaab804034bc;gz"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 592
expires: Thu, 25 Aug 2022 06:11:04 GMT

GET
H/1.1 200
OK ncu.svg
rbverifyportal.com/assets/ 102 KB
28 KB 103ms
50ms Image
image/svg+xml 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rbverifyportal.com/assets/ncu.svg
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: 3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
content-encoding: gzip
last-modified: Wed, 22 Jun 2022 00:19:16 GMT
etag: "19884-62b26004-f666e0dbf0513e77;gz"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 27808
expires: Thu, 25 Aug 2022 06:11:04 GMT

GET
H/1.1 200
OK house.svg
rbverifyportal.com/assets/ 2 KB
1 KB 100ms
47ms Image
image/svg+xml 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rbverifyportal.com/assets/house.svg
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: 8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
content-encoding: gzip
last-modified: Wed, 22 Jun 2022 00:19:56 GMT
etag: "64d-62b2602c-6137d86a3e94f3a6;gz"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 693
expires: Thu, 25 Aug 2022 06:11:04 GMT

GET
H/1.1 200
OK main.js Show response
rbverifyportal.com/assets/js/ 3 KB
1 KB 47ms
47ms Script
application/javascript 92.87.6.52
RTD Bucharest

General

Check archive.org

Show headers Download Go to

Full URL: http://rbverifyportal.com/assets/js/main.js
Requested by: Host: rbverifyportal.com
URL: http://rbverifyportal.com/login.php
Protocol: HTTP/1.1
Server: 92.87.6.52 Iasi, Romania, ASN9050 (RTD Bucharest, Romania, RO),
Reverse DNS
Software: /
Resource Hash: 4500e62ec70fff5859d3f515391f7f081a43f12ca279e570240487b959d360f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://rbverifyportal.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 18 Aug 2022 06:11:04 GMT
content-encoding: gzip
last-modified: Sun, 26 Jun 2022 18:11:06 GMT
etag: "c3b-62b8a13a-acb72eaf83f5c1a9;gz"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 758
expires: Thu, 25 Aug 2022 06:11:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Randolph Brooks Federal Credit Union (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rbverifyportal.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: mqf9867n33iauo6ktlur3ap7gk

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
rbverifyportal.com
2a00:1450:4001:82b::200a
92.87.6.52
0068843898265344ea1cf5dccdc4134ba29b548475c4ca6ab03935316aaa8cfa
09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884
13b6581e5665a9e516751b0326354eaeb7853be7cbe4153adc6cad59b683e889
17c72060acba211314dc6fb56a7493671ca538778310cab3afcc97cd53bd454a
3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759
3e79a7820b1c466e26cee45a9f4a33fd690a769d1e61af5a8df095e49c5057b4
4500e62ec70fff5859d3f515391f7f081a43f12ca279e570240487b959d360f7
8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152
f370b16182dc957112446e01a41c2583678502a40c99c3c81c22c32c13cd1af7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

rbverifyportal.com Open in urlscan Pro 92.87.6.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

20 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

70 kBTransfer

211 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

1 Cookies

Indicators

rbverifyportal.com Open in urlscan Pro
92.87.6.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

20 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

70 kB
Transfer

211 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!