aib-loginsecure.com Open in urlscan Pro
193.143.1.45  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response aib-loginsecure.com/	26 KB 7 KB	904ms 175ms	Document text/html	193.143.1.45 PROTON66
General Check archive.org Show headers Download Go to Full URL https://aib-loginsecure.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 193.143.1.45 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software openresty/1.25.3.1 / Resource Hash ace149cfcd4722a509e1f5be61c461b97f40e0187ab140fc166574c78d2af950 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Length 6651 Content-Type text/html Date Sat, 17 Aug 2024 00:41:16 GMT Server openresty/1.25.3.1 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br last-modified Wed, 24 Jul 2024 22:30:11 GMT vary Accept-Encoding
GET H/1.1	200 OK	main.css aib-loginsecure.com/assets/css/	169 KB 22 KB	182ms 180ms	Stylesheet text/css	193.143.1.45 PROTON66
General Check archive.org Show headers Download Go to Full URL https://aib-loginsecure.com/assets/css/main.css Requested by Host: aib-loginsecure.com URL: https://aib-loginsecure.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 193.143.1.45 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software openresty/1.25.3.1 / Resource Hash 00df1f3b821e4af953ed7f59345fd131206ac5f592027f63bfa5d840b538353c Request headers Referer https://aib-loginsecure.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Sat, 17 Aug 2024 00:41:16 GMT content-encoding br last-modified Sat, 26 Oct 1985 01:15:00 GMT Server openresty/1.25.3.1 vary Accept-Encoding Content-Type text/css cache-control public, max-age=604800 Connection keep-alive accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" Content-Length 21834 expires Sat, 24 Aug 2024 00:41:16 GMT
GET H/1.1	200 OK	aib.bundle.0c34e3c77f089244.js Show response aib-loginsecure.com/assets/scripts/	26 KB 9 KB	526ms 183ms	Script text/javascript	193.143.1.45 PROTON66
General Check archive.org Show headers Download Go to Full URL https://aib-loginsecure.com/assets/scripts/aib.bundle.0c34e3c77f089244.js Requested by Host: aib-loginsecure.com URL: https://aib-loginsecure.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 193.143.1.45 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software openresty/1.25.3.1 / Resource Hash ae4689d1ecc3b2e93405980c2b2fbc3dffedcaea797f50880ca93ec7ccba1690 Request headers Referer https://aib-loginsecure.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Sat, 17 Aug 2024 00:41:17 GMT content-encoding br last-modified Sat, 26 Oct 1985 01:15:00 GMT Server openresty/1.25.3.1 vary Accept-Encoding Content-Type text/javascript Connection keep-alive accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" Content-Length 8697
GET H/1.1	200 OK	ProximaNova-Bold.otf auth.aib.ie/assets/fonts/proxima-nova/	62 KB 63 KB	907ms 159ms	Font application/vnd.oasis.opendocument.formula-template	194.69.199.12 AIB-AS-1
General Check archive.org Show headers Download Go to Full URL https://auth.aib.ie/assets/fonts/proxima-nova/ProximaNova-Bold.otf Requested by Host: aib-loginsecure.com URL: https://aib-loginsecure.com/assets/css/main.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.69.199.12 , Ireland, ASN16282 (AIB-AS-1, IE), Reverse DNS Software / Resource Hash b9e81a47aecd3d05445ae775f48d08b3de46b2039f1d229a58a87be194e327ec Security Headers Name Value Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; img-src 'self' p.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; base-uri 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk https://onlinebanking.ebs.ie Strict-Transport-Security max-age=15552000; includeSubDomains Request headers Referer https://aib-loginsecure.com/ Origin https://aib-loginsecure.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Sat, 17 Aug 2024 00:41:18 GMT Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; img-src 'self' p.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; base-uri 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk https://onlinebanking.ebs.ie Referrer-Policy origin Strict-Transport-Security max-age=15552000; includeSubDomains Last-Modified Sat, 26 Oct 1985 08:15:00 GMT Content-Type application/vnd.oasis.opendocument.formula-template Access-Control-Allow-Origin * Cache-Control max-age=0, must-revalidate Content-Length 63808
GET H/1.1	200 OK	ProximaNova-Regular.otf auth.aib.ie/assets/fonts/proxima-nova/	61 KB 63 KB	909ms 163ms	Font application/vnd.oasis.opendocument.formula-template	194.69.199.12 AIB-AS-1
General Check archive.org Show headers Download Go to Full URL https://auth.aib.ie/assets/fonts/proxima-nova/ProximaNova-Regular.otf Requested by Host: aib-loginsecure.com URL: https://aib-loginsecure.com/assets/css/main.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.69.199.12 , Ireland, ASN16282 (AIB-AS-1, IE), Reverse DNS Software / Resource Hash 2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9 Security Headers Name Value Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; img-src 'self' p.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; base-uri 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk https://onlinebanking.ebs.ie Strict-Transport-Security max-age=15552000; includeSubDomains Request headers Referer https://aib-loginsecure.com/ Origin https://aib-loginsecure.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Sat, 17 Aug 2024 00:41:18 GMT Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; img-src 'self' p.typekit.net https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; base-uri 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie https://*.aibni.co.uk https://*.aibgb.co.uk https://onlinebanking.ebs.ie Referrer-Policy origin Strict-Transport-Security max-age=15552000; includeSubDomains Last-Modified Sat, 26 Oct 1985 08:15:00 GMT Content-Type application/vnd.oasis.opendocument.formula-template Access-Control-Allow-Origin * Cache-Control max-age=0, must-revalidate Content-Length 62892
GET H/1.1	200 OK	favicon.ico aib-loginsecure.com/	5 KB 2 KB	184ms 183ms	Other image/x-icon	193.143.1.45 PROTON66
General Check archive.org Show headers Download Go to Full URL https://aib-loginsecure.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 193.143.1.45 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software openresty/1.25.3.1 / Resource Hash e91ac6061e8c59eec248c44ba2c63b34ac613775231e229cacb40c75bc048300 Request headers Referer https://aib-loginsecure.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Sat, 17 Aug 2024 00:41:18 GMT content-encoding br last-modified Wed, 24 Jul 2024 22:32:24 GMT Server openresty/1.25.3.1 vary Accept-Encoding Content-Type image/x-icon cache-control public, max-age=604800 Connection keep-alive accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" Content-Length 1545 expires Sat, 24 Aug 2024 00:41:18 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Allied Irish Banks (Banking)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| aib function| aibShowTroubleLoggingInReg function| aibHideTroubleLoggingInReg function| postForgotPassword function| postRecoverUsername function| postAlternateAuthnSystem function| postRegistration function| postOk function| getApplicationName function| submitForm function| resetForm function| postCancel function| postOnReturn function| setFocus function| setMobile function| getScreenWidth object| bodyTag number| width function| IsWebAuthnSupported function| isWebAuthnPlatformAuthenticatorAvailable

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://aib-loginsecure.com/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "username"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aib-loginsecure.com
auth.aib.ie
193.143.1.45
194.69.199.12
00df1f3b821e4af953ed7f59345fd131206ac5f592027f63bfa5d840b538353c
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
ace149cfcd4722a509e1f5be61c461b97f40e0187ab140fc166574c78d2af950
ae4689d1ecc3b2e93405980c2b2fbc3dffedcaea797f50880ca93ec7ccba1690
b9e81a47aecd3d05445ae775f48d08b3de46b2039f1d229a58a87be194e327ec
e91ac6061e8c59eec248c44ba2c63b34ac613775231e229cacb40c75bc048300