sc0tiareferencealert4.com
Open in
urlscan Pro
104.131.167.45
Malicious Activity!
Public Scan
Effective URL: https://sc0tiareferencealert4.com/index91484101498.html?02ef4e007115965e34fb62cf5c1b3eef
Submission: On January 23 via manual from CA
Summary
TLS certificate: Issued by R3 on January 22nd 2021. Valid for: 3 months.
This is the only time sc0tiareferencealert4.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Scotiabank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 20 | 104.131.167.45 104.131.167.45 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
3 | 2a02:26f0:6c0... 2a02:26f0:6c00:294::51e | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 104.111.252.149 104.111.252.149 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 3 | 52.49.92.20 52.49.92.20 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 34.251.184.34 34.251.184.34 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 15.237.76.117 15.237.76.117 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 99.81.11.244 99.81.11.244 | 16509 (AMAZON-02) (AMAZON-02) | |
28 | 7 |
ASN14061 (DIGITALOCEAN-ASN, US)
sc0tiareferencealert4.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-252-149.deploy.static.akamaitechnologies.com
auth.scotiaonline.scotiabank.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-92-20.eu-west-1.compute.amazonaws.com
dpm.demdex.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-184-34.eu-west-1.compute.amazonaws.com
scotiabank.demdex.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-76-117.eu-west-3.compute.amazonaws.com
somniture.scotiabank.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-11-244.eu-west-1.compute.amazonaws.com
cm.everesttech.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
sc0tiareferencealert4.com
1 redirects
sc0tiareferencealert4.com |
16 KB |
5 |
scotiabank.com
dmtags.scotiabank.com auth.scotiaonline.scotiabank.com somniture.scotiabank.com |
67 KB |
4 |
demdex.net
1 redirects
dpm.demdex.net scotiabank.demdex.net |
4 KB |
1 |
everesttech.net
1 redirects
cm.everesttech.net |
517 B |
28 | 4 |
Domain | Requested by | |
---|---|---|
20 | sc0tiareferencealert4.com |
1 redirects
sc0tiareferencealert4.com
|
3 | dpm.demdex.net |
1 redirects
sc0tiareferencealert4.com
|
3 | dmtags.scotiabank.com |
sc0tiareferencealert4.com
dmtags.scotiabank.com |
1 | cm.everesttech.net | 1 redirects |
1 | somniture.scotiabank.com |
dmtags.scotiabank.com
|
1 | scotiabank.demdex.net |
dmtags.scotiabank.com
|
1 | auth.scotiaonline.scotiabank.com |
sc0tiareferencealert4.com
|
28 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.scotiabank.com |
assets.kampyle.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sc0tiareferencealert4.com R3 |
2021-01-22 - 2021-04-22 |
3 months | crt.sh |
apps.scotiabank.com Entrust Certification Authority - L1K |
2020-08-21 - 2022-11-20 |
2 years | crt.sh |
auth.scotiabank.com Entrust Certification Authority - L1K |
2020-02-27 - 2022-02-27 |
2 years | crt.sh |
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1 |
2020-12-02 - 2022-01-02 |
a year | crt.sh |
somniture.scotiabank.com Entrust Certification Authority - L1K |
2020-07-29 - 2022-09-29 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://sc0tiareferencealert4.com/index91484101498.html?02ef4e007115965e34fb62cf5c1b3eef
Frame ID: 3A054F843B40F6428703F4E05B198894
Requests: 27 HTTP requests in this frame
Frame:
https://scotiabank.demdex.net/dest5.html?d_nsid=0
Frame ID: 3CE9455B546D5E9E13EE5448C48A483B
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://sc0tiareferencealert4.com/
HTTP 301
https://sc0tiareferencealert4.com/ Page URL
- https://sc0tiareferencealert4.com/index91484101498.html?02ef4e007115965e34fb62cf5c1b3eef Page URL
Detected technologies
Debian (Operating Systems) ExpandDetected patterns
- headers server /Debian/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: Scotiabank
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Feedback
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://sc0tiareferencealert4.com/
HTTP 301
https://sc0tiareferencealert4.com/ Page URL
- https://sc0tiareferencealert4.com/index91484101498.html?02ef4e007115965e34fb62cf5c1b3eef Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://sc0tiareferencealert4.com/ HTTP 301
- https://sc0tiareferencealert4.com/
- https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0AAF22CE52827A080A490D4D%40AdobeOrg&d_nsid=0&ts=1611369378922 HTTP 302
- https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0AAF22CE52827A080A490D4D%40AdobeOrg&d_nsid=0&ts=1611369378922
- https://cm.everesttech.net/cm/dd?d_uuid=80357556384140002414335042827172929839 HTTP 302
- https://dpm.demdex.net/ibs:dpid=411&dpuuid=YAuLowAAAJEK5CTQ
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sc0tiareferencealert4.com/ Redirect Chain
|
334 B 501 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
index91484101498.html
sc0tiareferencealert4.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index91484101498.html
sc0tiareferencealert4.com/ |
80 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
launch-edbf66c903b6.min.js
dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/ |
182 KB 51 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7c428f63a00e5bd025fa159e8c94389f.svg
auth.scotiaonline.scotiabank.com/assets/ |
537 B 889 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
resource-loader.js
sc0tiareferencealert4.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.6a56e9d9c8681dee3c24.js
sc0tiareferencealert4.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.a8bf77b7a9385c624a8d.chunk.js
sc0tiareferencealert4.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3855b6f925rn166fe78bc4a41fd90c6d
sc0tiareferencealert4.com/resources/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.0707e8a14e8f4598c453.css
sc0tiareferencealert4.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rd
dpm.demdex.net/id/ Redirect Chain
|
5 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AppMeasurement.min.js
dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/ecc159fc6086/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/ |
33 KB 13 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AppMeasurement_Module_ActivityMap.min.js
dmtags.scotiabank.com/launch/novaweb/27c34d6e7144/094054a424e3/ecc159fc6086/hostedLibFiles/EPbde2f7ca14e540399dcc1f8208860b7b/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
dest5.html
scotiabank.demdex.net/ Frame 3CE9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
somniture.scotiabank.com/ |
48 B 516 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibs:dpid=411&dpuuid=YAuLowAAAJEK5CTQ
dpm.demdex.net/ Redirect Chain
|
42 B 915 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
15243e297f5364bd59f4088a864abbf7.woff
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8fd30bd010d9e2c7677ec339685f958b.woff
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
00cecde981e3ef7491eba946f4b95fe0.woff
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8424a042624210828b0fbe7a8c533b2a.woff2
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1e98970fd9c76545bbf1e1a377f4f3c2.woff2
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
50805f331bb1b697aafb6f0c28b09212.woff2
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3ca6c3facf3966b88b55118f7821ee72.woff2
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7e2a698e9980c7ba52f69a2717e97b86.woff
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0a9f36f23c26fbad0827f0a8ec86c908.woff
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
64a8523319c68ca5e492309a68af4a9e.woff2
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12b6c5fcbc2e61c7ba17f51cd9c2b8c0.ttf
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
811a29d581fc684aa63616499cad4782.ttf
sc0tiareferencealert4.com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- sc0tiareferencealert4.com
- URL
- https://sc0tiareferencealert4.com/index91484101498.html?02ef4e007115965e34fb62cf5c1b3eef
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Scotiabank (Banking)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| process object| LD_CONFIG object| savedUsers object| appEventData number| _dataLayerOverwriteMonitor function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq function| AppMeasurement_Module_ActivityMap object| s object| REDUX_STATE object| webpackJsonp object| antiClickjack object| _cf4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.demdex.net/ | Name: demdex Value: 80357556384140002414335042827172929839 |
|
.sc0tiareferencealert4.com/ | Name: AMCV_0AAF22CE52827A080A490D4D%40AdobeOrg Value: 359503849%7CMCIDTS%7C18651%7CMCMID%7C71039842120852719073547705481045625917%7CMCAAMLH-1611974179%7C6%7CMCAAMB-1611974179%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1611376579s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18658%7CvVersion%7C5.0.1 |
|
.demdex.net/ | Name: dextp Value: 269-1-1611369379565|358-1-1611369379666 |
|
.sc0tiareferencealert4.com/ | Name: AMCVS_0AAF22CE52827A080A490D4D%40AdobeOrg Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.scotiaonline.scotiabank.com
cm.everesttech.net
dmtags.scotiabank.com
dpm.demdex.net
sc0tiareferencealert4.com
scotiabank.demdex.net
somniture.scotiabank.com
sc0tiareferencealert4.com
104.111.252.149
104.131.167.45
15.237.76.117
2a02:26f0:6c00:294::51e
34.251.184.34
52.49.92.20
99.81.11.244
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
27003cb4bc3d4671f4a5799201e1db1a7a577d45abc8d812e12c34b16011b50f
51bf40e3535dee036bec3df6d4b279b4373fb22cdd40632535932d6999f7e37e
660e1b388e44e7f62e72121ef535cd316c543475a704888e4d7f130de0eedd7b
aaceea64ee81bc59d7e3b274d995e0a1e88e0aed37e5d51fbda1189feb722ac5
aee4623510fc8eb29da73b6e2ab79d118f9a04598078afc51766e8b9e6118d3c
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
ecefa632b409f50e7fc0fcfe6c55c14c7e0f15a32f4cf1cbba2943baa581ac54
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629