akbch-5.click Open in urlscan Pro
69.49.228.120 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://akbch-5.click/
Effective URL:
https://akbch-5.click/auth/Login
Submission: On August 13 via manual (August 13th 2024, 7:11:01 am UTC) from CH — Scanned from CH

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 69.49.228.120, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is akbch-5.click.
TLS certificate: Issued by R11 on August 1st 2024. Valid for: 3 months.

This is the only time akbch-5.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aargauische Kantonalbank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 4	69.49.228.120 69.49.228.120		19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
4	2

4 69.49.228.120 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-228-120.webhostbox.net

akbch-5.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	akbch-5.click 1 redirects akbch-5.click	580 KB
0	akb.ch Failed www.akb.ch Failed
4	2

	Domain	Requested by
4	akbch-5.click	1 redirects akbch-5.click
0	www.akb.ch Failed	akbch-5.click
4	2

This site contains no links.

Subject Issuer	Validity	Valid
akbch-5.click R11	`2024-08-01` - `2024-10-30`	3 months	crt.sh

This page contains 1 frames:

Frame: https://www.akb.ch/auth/login
Frame ID: 8A8EDF780EE405106ECD825ABD7F457F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login AKB e-Banking | Aargauische Kantonalbank

Page URL History Show full URLs

http://akbch-5.click/ HTTP 307
https://akbch-5.click/ HTTP 302
https://akbch-5.click/auth/Login Page URL

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

678 kB
Transfer

684 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://akbch-5.click/ HTTP 307
https://akbch-5.click/ HTTP 302
https://akbch-5.click/auth/Login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

http://www.akb.ch/auth/login HTTP 307
https://www.akb.ch/auth/login HTTP 307
http://www.akb.ch/auth/login HTTP 301
https://www.akb.ch/auth/login

4 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 Ok	Primary Request Login Show response akbch-5.click/auth/ Redirect Chain http://akbch-5.click/ https://akbch-5.click/ https://akbch-5.click/auth/Login	421 KB 421 KB	127ms 127ms	Document text/html	69.49.228.120 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://akbch-5.click/auth/Login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 69.49.228.120 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 69-49-228-120.webhostbox.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 / PHP/7.3.33 Resource Hash `eb992619a114fbb5fff98f127ef2eb8f17154ab2fb7aa19de4a67c67d9553795` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 13 Aug 2024 07:10:16 GMT Keep-Alive timeout=5, max=99 Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 Transfer-Encoding chunked X-Powered-By PHP/7.3.33 Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Tue, 13 Aug 2024 07:10:16 GMT Keep-Alive timeout=5, max=100 Location /auth/Login Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 X-Powered-By PHP/7.3.33
GET DATA	200 OK	truncated /	22 KB 22 KB		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `22e7a1b10c110072f5a0bfd16e2197a76b279ec879bcce8978fada1dc9ee5d40` Request headers Referer Origin https://akbch-5.click User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type font/woff
GET DATA	200 OK	truncated /	7 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2dfa2fc79dcff512a23b00dac1f0dba0e8028079779d3aed9f689aa59c0f22b3` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	37 KB 37 KB		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `67a6adfab1e3b566ccd7c6df91fbaac21ddbe239c542858e5860d603e1d24734` Request headers Referer Origin https://akbch-5.click User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type font/woff
GET DATA	200 OK	truncated /	22 KB 22 KB		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a0357cb694b5284870c77c0dbcaf33f238004800419288afde313317b0dbd0b7` Request headers Referer Origin https://akbch-5.click User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type font/woff
GET DATA	200 OK	truncated /	18 KB 18 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dd642d0e6dda3c8aaadc34498a24d0e31ac0fb0390970948fad8132c815857b9` Request headers Referer Origin https://akbch-5.click User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
POST H/1.1	200 OK	security.php Show response akbch-5.click/	18 B 277 B	190ms 189ms	XHR text/html	69.49.228.120 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://akbch-5.click/security.php Requested by Host: akbch-5.click URL: https://akbch-5.click/auth/Login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 69.49.228.120 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 69-49-228-120.webhostbox.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 / PHP/7.3.33 Resource Hash `1d31dec0fc43c187e66a79c1a1d99071f1444bd3db56bdef2e3cc2d16326937f` Request headers Referer https://akbch-5.click/auth/Login User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryYVyaFkIm2XaSRcOk Response headers Date Tue, 13 Aug 2024 07:10:16 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 Connection Keep-Alive X-Powered-By PHP/7.3.33 Content-Length 18 Keep-Alive timeout=5, max=98 Content-Type text/html; charset=UTF-8
GET H/1.1	200 Ok	wait.gif akbch-5.click/	158 KB 158 KB	318ms 126ms	Image text/html	69.49.228.120 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Show image Full URL https://akbch-5.click/wait.gif Requested by Host: akbch-5.click URL: https://akbch-5.click/auth/Login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 69.49.228.120 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 69-49-228-120.webhostbox.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 / PHP/7.3.33 Resource Hash `fd9317368fc71347e750fbbf37b8f291334e884cbe143513cbf394a436b661fa` Request headers Referer https://akbch-5.click/auth/Login User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Date Tue, 13 Aug 2024 07:10:17 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33 Connection Keep-Alive X-Powered-By PHP/7.3.33 Keep-Alive timeout=5, max=97 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET		login www.akb.ch/auth/ Redirect Chain http://www.akb.ch/auth/login https://www.akb.ch/auth/login http://www.akb.ch/auth/login https://www.akb.ch/auth/login	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.akb.ch
URL: https://www.akb.ch/auth/login

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aargauische Kantonalbank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://akbch-5.click/auth/Login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

akbch-5.click
www.akb.ch
www.akb.ch
69.49.228.120
1d31dec0fc43c187e66a79c1a1d99071f1444bd3db56bdef2e3cc2d16326937f
22e7a1b10c110072f5a0bfd16e2197a76b279ec879bcce8978fada1dc9ee5d40
2dfa2fc79dcff512a23b00dac1f0dba0e8028079779d3aed9f689aa59c0f22b3
67a6adfab1e3b566ccd7c6df91fbaac21ddbe239c542858e5860d603e1d24734
a0357cb694b5284870c77c0dbcaf33f238004800419288afde313317b0dbd0b7
dd642d0e6dda3c8aaadc34498a24d0e31ac0fb0390970948fad8132c815857b9
eb992619a114fbb5fff98f127ef2eb8f17154ab2fb7aa19de4a67c67d9553795
fd9317368fc71347e750fbbf37b8f291334e884cbe143513cbf394a436b661fa

akbch-5.click Open in urlscan Pro 69.49.228.120 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

75 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

678 kBTransfer

684 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

akbch-5.click Open in urlscan Pro
69.49.228.120 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

678 kB
Transfer

684 kB
Size

0
Cookies

4 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!