securelogin.live
Open in
urlscan Pro
198.187.29.46
Malicious Activity!
Public Scan
URL:
http://securelogin.live/bankofamerica.com/
Submission: On October 31 via automatic, source phishtank
Submission: On October 31 via automatic, source phishtank
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 16 HTTP transactions.
The main IP is 198.187.29.46, located in
Los Angeles, United States and
belongs to NAMECHEAP-NET - Namecheap, Inc., US.
The main domain is securelogin.live.
This is the only time securelogin.live was scanned on urlscan.io!
This is the only time securelogin.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 16 | 198.187.29.46 198.187.29.46 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
| 16 | 1 |
16
198.187.29.46
(Los Angeles, United States)
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server263-4.web-hosting.com
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server263-4.web-hosting.com
| securelogin.live |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
securelogin.live
securelogin.live |
270 KB |
| 16 | 1 |
| Domain | Requested by | |
|---|---|---|
| 16 | securelogin.live |
securelogin.live
|
| 16 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://securelogin.live/bankofamerica.com/
Frame ID: 41F401F2627C48C0E6551F093A0C531C
Requests: 16 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
/
securelogin.live/bankofamerica.com/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bactouch.css
securelogin.live/bankofamerica.com/style/ |
101 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
toolbar.css
securelogin.live/bankofamerica.com/style/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bact_listview.css
securelogin.live/bankofamerica.com/style/ |
48 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer.css
securelogin.live/bankofamerica.com/style/ |
851 B 614 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
slidemenu.css
securelogin.live/bankofamerica.com/style/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.11.1.min.js
securelogin.live/bankofamerica.com/script/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mobileweb.js
securelogin.live/bankofamerica.com/script/ |
58 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.maskedinput.min.js
securelogin.live/bankofamerica.com/script/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prv.png
securelogin.live/bankofamerica.com/img/ |
60 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
eq.png
securelogin.live/bankofamerica.com/img/ |
59 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cpr.png
securelogin.live/bankofamerica.com/img/ |
64 KB 64 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
header.png
securelogin.live/bankofamerica.com/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
message.png
securelogin.live/bankofamerica.com/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
close.png
securelogin.live/bankofamerica.com/img/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite_input.png
securelogin.live/bankofamerica.com/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)105 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| globalObj function| popup function| encryptA function| decryptA function| loadWarplet function| confirmPopup function| confirmbottomPopup function| actionSheetPopup function| showSplash function| showBannerMessage function| bannerTemplateStyling function| showSASIBanner function| splashMessage function| loadModule function| loadModuleJS function| getPageFooter function| footerWrapper function| loadTemplate function| leavingAppSignOff function| isValidEntity function| isValidCharWithUnderscore function| isAlphaNumericWithSpaces function| isValidChar function| isAlphaStr function| isAlphaNumWithUnderscoreStr function| isAlphaNumWithSpacesStr function| isDOB function| isDate function| isLessThan13 function| isValidPasscodeSpecialStr function| isValidPasscodeNewSpecialStr function| addAuthValidationRegexes function| initiatedynamicFormatChecker function| onlineIDFormatChecker function| passcodeFormatChecker function| isAlphaNumNewOnlineIdSpecialChars function| isAlphaNumOnlineIdSpecialChars function| maskOnlineId function| setCookie function| getCookie function| deleteCookie function| setCookieObj function| getCookieString function| areCookiesEnabled function| cloneObj function| noScroll function| setDimensions function| resizePopups function| showLoading function| hideLoading function| showListLoading function| hideListLoading function| queryParamsFor function| convertToDefaultDate function| isValidAmount function| scrubLinks function| signOff function| disposeObjects function| sendSignOff function| processConfirmPopup function| checkSignOffMessage function| checkWebTimeout function| resetTimeout function| stopTimeout function| startTimeout function| checkTimeout function| timedOut function| nativeToWebviewTrigger function| updateBarkerCount function| menuItemTally function| setTally function| eliminateAuthVariables function| setSlideOverMenuEvent function| loadSlideMenu function| setPageTitle function| getState function| networkUnavailable function| generateUUID function| altListView function| filterResponse object| blackListCharsMapping function| escapeHtmlChars object| iPadheader object| DeviceName function| detectDeviceInfo function| closeMessage function| makeScroller function| generateCLRequestID function| showCoachMark function| detectSwipeOn function| showToggleSlider function| hideToggleSlider function| encrypt function| triggerBusinessEvent function| detectPinchZoom function| getHolidayList function| sasiBusEvent function| queryString function| getParameterByName function| refreshAccounts function| valid_ca1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| securelogin.live/ | Name: PHPSESSID Value: a4f6ec5266600fb98b9f231bd6c959ab |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
securelogin.live
198.187.29.46
0e9dd73dab9a0922780b2a9ca768b2e7040602123a2dba38d9c96390caa259b8
105296e66a93575f0da4c925e3207eb347c2dd552ec2bfb572070cea45998727
478a4f916db4b66d59ecdcb9dac8a8628d19c72c09263c9547979e77846de4e1
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
723fca598d0ae1aae3ab72990d04c3b86bc6c18b754f1f58507d39367dd6757b
79f936cdfc638028924d1707d20958261eb59bbff54ffb8317f4eec050e42d44
b23046e43a658d66847d3fb771a26e1673ab267b77427eab293f537de496f7e2
b4062fee456a8a45f649606b87ff0c5557f4c8018b39924dc4c3064fe6064447
b632fa1d4962522b6d07793c4f0a4d863bd520b122c5d10343a4004298d01592
bde4e74a5c3d7d06e5558fa425ff90ac46115940fe49ed242b858be4f71d1c20
c7c2fa48bcc272c726218fc9edfd91d7258c8b7b1a47c874d29355c40a8c4a7e
d1b09a34d6ffa1569b70e6f4f9ad6ec35ee0dd0d9c6342de44fabfee6ef107ce
d45d9a7cacfbeaf2796ec624e328354c3cde35f00518bd5a690429bcefa223dc
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
ed832ecc86f186321cd22b5d2c1ceb7845c52e69fba47801fdbe50c04eafb0ad
fb82877818fa23c8c028053cc5744c5d7947faca82bd50a82b918016499bfb62