bnk1001sco34-al5e1dr3t.com

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 91.234.99.166, located in Kiev, Ukraine and belongs to AS-MAROSNET Moscow, Russia, RU. The main domain is bnk1001sco34-al5e1dr3t.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 17th 2018. Valid for: 3 months.

This is the only time bnk1001sco34-al5e1dr3t.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Scotiabank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::6818:809	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	2606:4700:30:... 2606:4700:30::681b:ba0b	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 4	91.234.99.166 91.234.99.166	48666 (AS-MAROSN...) (AS-MAROSNET Moscow)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2

1 2606:4700:20::6818:809 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

to.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:ba0b (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

kutt.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 91.234.99.166 (Kiev, Ukraine) 1 redirects

ASN48666 (AS-MAROSNET Moscow, Russia, RU)

bnk1001sco34-al5e1dr3t.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	bnk1001sco34-al5e1dr3t.com 1 redirects bnk1001sco34-al5e1dr3t.com	246 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	kutt.it 1 redirects kutt.it	472 B
1	to.ly 1 redirects to.ly	447 B
4	4

	Domain	Requested by
4	bnk1001sco34-al5e1dr3t.com	1 redirects bnk1001sco34-al5e1dr3t.com
1	fonts.gstatic.com
1	kutt.it	1 redirects
1	to.ly	1 redirects
4	4

This site contains no links.

Subject Issuer	Validity	Valid
bnk1001sco34-al5e1dr3t.com cPanel, Inc. Certification Authority	`2018-11-17` - `2019-02-15`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2018-10-30` - `2019-01-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Frame ID: AF885B5AD7EA69B03B894A0B44C9C3FD
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://to.ly/1wKQa HTTP 301
https://kutt.it/ddxkJ7 HTTP 302
https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3 HTTP 301
https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/ Page URL

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

262 kB
Transfer

261 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://to.ly/1wKQa HTTP 301
https://kutt.it/ddxkJ7 HTTP 302
https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3 HTTP 301
https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Redirect Chain

https://to.ly/1wKQa
https://kutt.it/ddxkJ7
https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3
https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/

3 KB
4 KB

86ms
86ms

Document
text/html

91.234.99.166
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.234.99.166 Kiev, Ukraine, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 82bdfc876ae3c7a451b9aea1a3c3fa3d6053afa651bc44f98eed2b20619affdb

Request headers

Host: bnk1001sco34-al5e1dr3t.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Tue, 20 Nov 2018 00:23:10 GMT
Server: Apache
Last-Modified: Sun, 18 Nov 2018 16:16:06 GMT
Accept-Ranges: bytes
Content-Length: 3558
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Tue, 20 Nov 2018 00:23:10 GMT
Server: Apache
Location: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Content-Length: 262
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK css.css
bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/Scotiabank-BankingWeb_files/ 236 KB
236 KB 92ms
91ms Stylesheet
text/css 91.234.99.166
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/Scotiabank-BankingWeb_files/css.css
Requested by: Host: bnk1001sco34-al5e1dr3t.com
URL: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.234.99.166 Kiev, Ukraine, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: c54ab51f01b9b490939b339d65d34601798c166a252628eefc9854ecffa31f5f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: bnk1001sco34-al5e1dr3t.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Tue, 20 Nov 2018 00:23:10 GMT
Last-Modified: Sat, 30 Dec 2017 18:39:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 241416

GET
H/1.1 200
OK login-logo.svg
bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/Scotiabank-BankingWeb_files/ 6 KB
6 KB 216ms
63ms Image
image/svg+xml 91.234.99.166
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/Scotiabank-BankingWeb_files/login-logo.svg
Requested by: Host: bnk1001sco34-al5e1dr3t.com
URL: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.234.99.166 Kiev, Ukraine, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 5ad959fa5edbc9d44fc4b1a32e006395e9cd1f65b441dc8dc0de6e33e7cc6f50

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: bnk1001sco34-al5e1dr3t.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Tue, 20 Nov 2018 00:23:10 GMT
Last-Modified: Sat, 30 Dec 2017 18:40:52 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 6222

GET
S 200 MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2
fonts.gstatic.com/s/lato/v11/ 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80b::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v11/MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:80b::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://bnk1001sco34-al5e1dr3t.com/sco1r7el23hs23iwe3/Scotiabank-BankingWeb_files/css.css
Origin: https://bnk1001sco34-al5e1dr3t.com

Response headers

date: Wed, 14 Nov 2018 21:02:28 GMT
x-content-type-options: nosniff
last-modified: Mon, 06 Oct 2014 20:38:14 GMT
server: sffe
age: 444051
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 16436
x-xss-protection: 1; mode=block
expires: Thu, 14 Nov 2019 21:02:28 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| check object| _cf

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bnk1001sco34-al5e1dr3t.com
fonts.gstatic.com
kutt.it
to.ly
2606:4700:20::6818:809
2606:4700:30::681b:ba0b
2a00:1450:4001:80b::2003
91.234.99.166
5ad959fa5edbc9d44fc4b1a32e006395e9cd1f65b441dc8dc0de6e33e7cc6f50
82bdfc876ae3c7a451b9aea1a3c3fa3d6053afa651bc44f98eed2b20619affdb
b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f
c54ab51f01b9b490939b339d65d34601798c166a252628eefc9854ecffa31f5f

bnk1001sco34-al5e1dr3t.com Open in urlscan Pro 91.234.99.166 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

262 kBTransfer

261 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

bnk1001sco34-al5e1dr3t.com Open in urlscan Pro
91.234.99.166 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

262 kB
Transfer

261 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!