www.pattabhiagro.com
Open in
urlscan Pro
192.186.223.129
Malicious Activity!
Public Scan
URL:
http://www.pattabhiagro.com/bootstrap/css/citizens/verify.html
Submission: On June 17 via automatic, source openphish
Submission: On June 17 via automatic, source openphish
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 192.186.223.129, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US.
The main domain is www.pattabhiagro.com.
This is the only time www.pattabhiagro.com was scanned on urlscan.io!
This is the only time www.pattabhiagro.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citizens Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 192.186.223.129 192.186.223.129 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 7 | 174.128.65.144 174.128.65.144 | 63335 (CITIZENS-...) (CITIZENS-BANK-AS - RBS Citizens) | |
| 8 | 2 |
1
192.186.223.129
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-192-186-223-129.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-192-186-223-129.ip.secureserver.net
| www.pattabhiagro.com |
7
174.128.65.144
(Riverside, United States)
ASN63335 (CITIZENS-BANK-AS - RBS Citizens, NA, US)
ASN63335 (CITIZENS-BANK-AS - RBS Citizens, NA, US)
| www3.citizensbankonline.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
citizensbankonline.com
www3.citizensbankonline.com |
11 KB |
| 1 |
pattabhiagro.com
www.pattabhiagro.com |
4 KB |
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | www3.citizensbankonline.com |
www.pattabhiagro.com
|
| 1 | www.pattabhiagro.com | |
| 8 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.citizensbank.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www3.citizensbankonline.com Symantec Class 3 EV SSL CA - G3 |
2017-03-16 - 2019-03-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.pattabhiagro.com/bootstrap/css/citizens/verify.html
Frame ID: 13748.1
Requests: 8 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
URL: http://www.citizensbank.com/
Title:
Title:
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/security/default.aspx
Title: Privacy & Security
Title: Privacy & Security
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/misc/termsofuse.asp
Title: Terms of Use
Title: Terms of Use
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/pf/onlinebanking/online_guarantee.aspx
Title: Citizens Bank Online Guarantee
Title: Citizens Bank Online Guarantee
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
verify.html
www.pattabhiagro.com/bootstrap/css/citizens/ |
18 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pm_fp.js
www3.citizensbankonline.com/efs/efs/jsp-ns/ |
24 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citlogo.gif
www3.citizensbankonline.com/efs/efs/grafx/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
spacer.gif
www3.citizensbankonline.com/efs/efs/grafx/ |
42 B 42 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
home.gif
www3.citizensbankonline.com/efs/efs/grafx/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
btn_continue.gif
www3.citizensbankonline.com/efs/efs/grafx/ |
468 B 468 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ehl.gif
www3.citizensbankonline.com/efs/efs/grafx/ |
88 B 88 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_bg.jpg
www3.citizensbankonline.com/efs/efs/grafx/ |
667 B 667 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citizens Bank (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.pattabhiagro.com
www3.citizensbankonline.com
174.128.65.144
192.186.223.129
4ca664fa3f2df4dc0542d1d5be418688cb9b70eced933bfb76efcab7a37d45d8
5cd35c8ac4630375a6b89e2d770c6023bca82d772a6454e65135ec1713970ebd
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a88676de1836609194ae8a17b09966f99b505b11f69cc801c1f6c442f187d05d
ae571edfb75648a099b4bb67a1b33cf1be1133eac6d74e92a786f0303fc08298
d2c454e5be26b1dab56fc01f7e723e531d883b9d9f0c2f46f9efc63d644b7beb
d570f71cca1ef1b531281269207bb3808c31737c62f2b3b8169825fd0fe9f591
f38ccfb82832d5d520a762b30713c43d178f8e9b6e0f9f51970611f06636d6aa