ai.rheinmainprojects.com
Open in
urlscan Pro
83.138.83.128
Malicious Activity!
Public Scan
Effective URL: https://ai.rheinmainprojects.com/GTuhjd12/rcu/index.html
Submission: On March 27 via api from US — Scanned from JP
Summary
TLS certificate: Issued by R3 on March 13th 2023. Valid for: 3 months.
This is the only time ai.rheinmainprojects.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Royal Credit Union (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
26 | 83.138.83.128 83.138.83.128 | 34895 (HOSTNET-D...) (HOSTNET-DE-AS) | |
27 | 2 |
ASN34895 (HOSTNET-DE-AS, DE)
PTR: dunigo.han-solo.net
ai.rheinmainprojects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
rheinmainprojects.com
ai.rheinmainprojects.com |
139 KB |
1 |
web.app
mob7ls-royalcu.web.app |
484 B |
27 | 2 |
Domain | Requested by | |
---|---|---|
26 | ai.rheinmainprojects.com |
ai.rheinmainprojects.com
|
1 | mob7ls-royalcu.web.app | |
27 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1D4 |
2023-03-06 - 2023-06-04 |
3 months | crt.sh |
ai.rheinmainprojects.com R3 |
2023-03-13 - 2023-06-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ai.rheinmainprojects.com/GTuhjd12/rcu/index.html
Frame ID: 833B396E2188C15B9B163DDFC878A8E2
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
Royal Credit Union | LoginPage URL History Show full URLs
- https://mob7ls-royalcu.web.app/ Page URL
- https://ai.rheinmainprojects.com/GTuhjd12/rcu/index.html Page URL
Detected technologies
React (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+data-react
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://mob7ls-royalcu.web.app/ Page URL
- https://ai.rheinmainprojects.com/GTuhjd12/rcu/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
mob7ls-royalcu.web.app/ |
236 B 484 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
ai.rheinmainprojects.com/GTuhjd12/rcu/ |
78 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LAB.min.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
VisitorAPI.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
45 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AppMeasurement.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
76 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframeResizer.min.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DBKAPI.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.69265a18.chunk.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
244 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
88.7d44ab6f.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
16.61e0d010.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10.27b24112.chunk.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
25 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10.da1657cc.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
45.16a92a7e.chunk.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
45.b63e3956.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
81.23738d9b.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
12.06f46345.chunk.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
2 KB 775 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
12.38ae5202.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 82 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.046584cc.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61.7df84e14.chunk.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
2 KB 619 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61.a6620c9f.chunk.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
14 B 65 B |
Script
text/js |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UIFlexibilityBranding.js
ai.rheinmainprojects.com/GTuhjd12/rcu/js/ |
0 68 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LoginWidget.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UIFlexibilityBranding.css
ai.rheinmainprojects.com/flex-adm-app/live/branding/static/css/ |
20 B 90 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
safe.png
ai.rheinmainprojects.com/GTuhjd12/rcu/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
branding.css
ai.rheinmainprojects.com/GTuhjd12/rcu/css/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iPhone.jpg
ai.rheinmainprojects.com/GTuhjd12/rcu/ |
47 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Royal Credit Union (Financial)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| $LAB function| Visitor function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| iFrameResize object| dbk0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ai.rheinmainprojects.com
mob7ls-royalcu.web.app
2620:0:890::100
83.138.83.128
057d284b90497341f4b10b8e5c0c73076b6b2abcde63d5614b20a72d95a30c7d
0800aaa7d0e97a6244e7e0a29d0432e827c89c2b175139832a5bf3016b531757
140ad0548493347ee3fd7b933dc02b33291d5f596503b1551c9a70e7130d627d
216cb3ad628333664a0a514b6a05c3a8e1dfa1acc54e3bf3304a1b891684675d
2fee3d9d7fbfb009f866d605a58a06edc23a0805afb4648dda3cdd0386724c70
31d3f5a6863cb1040612ef93afb8b98090f83c6f0dd75e557a98af775b51538f
3521021a2e875fbc52ae82e2a3fea5024d507bbc919f504ca8521292c3fe14d3
3671049256031f485c0c37c39f2fbdb807e20cd1795047c09e9029edb3838049
4189c02752e97155aa5de641ec3d10c66e422111025a99422cf574f82e8393ae
643788c955df57f9f3be0be1caaf2a2082479faa94304bc1c2a1eec1a4c92119
770b682ad497f5a1dc896e3b31ed9182fa203b486ddce5c44385dae2cf008728
7f46e16eda1fc7b95637ec47468901d9704ffd44d7cb738c13d3caffad39796b
971c47f1144e3bcaaafbd8ca281cc33a757b858524598ffded485107104575be
a2b2502753e00dedffb07d328187eec2176daa0d664f4fc372c9326126d26aab
b1b4bc4ee08fae3e5c992567fa7bf7cc995e709cdd8898154104f5d561eb0b6d
ba3930737875a69e72b03cb9c74fe98576487076cfba3aa1693a02134ae7d336
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6ad9727eb8450f677a7af50d77cd9cd3fa58054c577061c7b13e65496aa98da
f2c845a1cc9df791dbfd665066e2418b67703670b35b2b7423fcc2cf3f71c58f