urlscan.io logo urlscan.io
SecurityTrails logo

gracegives.sddev.com.au Open in urlscan Pro
45.120.149.223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data...
Submission: On May 27 via manual from RS — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 45.120.149.223, located in Singapore and belongs to A2HOSTING, US. The main domain is gracegives.sddev.com.au.
This is the only time gracegives.sddev.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

IP Address AS Autonomous System
5 45.120.149.223 55293 (A2HOSTING)
1 2606:4700:303... 13335 (CLOUDFLAR...)
6 3
Apex Domain
Subdomains		 Transfer
5 sddev.com.au
gracegives.sddev.com.au
351 KB
1 js-codes.com
js-codes.com
2 KB
6 2
Domain Requested by
5 gracegives.sddev.com.au gracegives.sddev.com.au
1 js-codes.com gracegives.sddev.com.au
6 2

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-03 -
2022-07-02		 a year crt.sh

This page contains 1 frames:

Primary Page: http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
Frame ID: FF6FF2705E85FD52C967D2FF01B37FFE
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

17 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

371 kB
Transfer

371 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request authen.php
gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/ 		958 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
Protocol
HTTP/1.1
Server
45.120.149.223 , Singapore, ASN55293 (A2HOSTING, US),
Reverse DNS
server.shoredev.com.au
Software
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4 /
Resource Hash
5b6c26db9ef83b2749ceb2aa3078cd6f97d852c41c663420155c2ac9c87f8d44

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Fri, 27 May 2022 13:29:24 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4
Transfer-Encoding
chunked
main.css
gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/css/ 		243 KB
243 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/css/main.css
Requested by
Host: gracegives.sddev.com.au
URL: http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
Protocol
HTTP/1.1
Server
45.120.149.223 , Singapore, ASN55293 (A2HOSTING, US),
Reverse DNS
server.shoredev.com.au
Software
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4 /
Resource Hash
84e42d885197aa7bf88b3034cbba6d7dfaa0d85bd7648fc0415547a2688416d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 13:29:26 GMT
Last-Modified
Thu, 26 May 2022 23:50:14 GMT
Server
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4
ETag
"223e59-3cba0-5dff2d9e07d42"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
248736
modernizr.min.js
js-codes.com/modernizr/2.9.7/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-codes.com/modernizr/2.9.7/modernizr.min.js
Requested by
Host: gracegives.sddev.com.au
URL: http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:c763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express, Phusion Passenger(R) 6.0.10
Resource Hash
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gracegives.sddev.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 13:29:26 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by
Express, Phusion Passenger(R) 6.0.10
status
200 OK
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 11 Oct 2017 07:04:24 GMT
server
cloudflare
etag
W/"edf-15f0a3fa4c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YFes8Z5qPvs5faTdJiycsSPmmM%2Fnm5qmp96cHfmWdWEQPTE2MQtvmn1XDPecaQCbB%2FlYMoiYr6BNoz5QkgmEbjiA%2BNELhO83SNGRM2Mq37shwHyQSSLcGgmTPLtyJEWVtItDGO2OwD809Xs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
cf-ray
711f19721b4a5c56-FRA
expires
Sat, 27 May 2023 13:29:26 GMT
jquery.js
gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/js/ 		85 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/js/jquery.js
Requested by
Host: gracegives.sddev.com.au
URL: http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
Protocol
HTTP/1.1
Server
45.120.149.223 , Singapore, ASN55293 (A2HOSTING, US),
Reverse DNS
server.shoredev.com.au
Software
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4 /
Resource Hash
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 13:29:26 GMT
Last-Modified
Thu, 26 May 2022 23:50:14 GMT
Server
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4
ETag
"223e78-15339-5dff2d9e0db01"
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
86841
step1.html
gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/html/ 		19 KB
20 KB 		XHR
General
Check archive.org
Download Go to
Full URL
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/html/step1.html
Requested by
Host: gracegives.sddev.com.au
URL: http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/js/jquery.js
Protocol
HTTP/1.1
Server
45.120.149.223 , Singapore, ASN55293 (A2HOSTING, US),
Reverse DNS
server.shoredev.com.au
Software
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4 /
Resource Hash
43c0043febe9e0bca44107be87a818a5c52b6e6403a46a4d4434a3534b418167

Request headers

Accept
*/*
Referer
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 13:29:27 GMT
Last-Modified
Thu, 26 May 2022 23:50:14 GMT
Server
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4
ETag
"223e5d-4cd4-5dff2d9e0b3f1"
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
19668
ico.svg
gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/layout/img/ico.svg
Protocol
HTTP/1.1
Server
45.120.149.223 , Singapore, ASN55293 (A2HOSTING, US),
Reverse DNS
server.shoredev.com.au
Software
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4 /
Resource Hash
23e28fb9caae86765cb008b5d1eb45fc0c33e07f338b22a458e136576c667c01

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gracegives.sddev.com.au/wp-content/plugins/rabu26/tmp/wwww.bank0famerica.net.preffered.card.secure.dashboard.portal.data.submit.id/home/authen.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 13:29:27 GMT
Last-Modified
Thu, 26 May 2022 23:50:14 GMT
Server
Apache/2.4.53 (cPanel) OpenSSL/1.1.1n mod_bwlimited/1.4
ETag
"223e6b-644-5dff2d9e0c391"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1604
truncated
/ 		17 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171

Request headers

Referer
http://gracegives.sddev.com.au/
Origin
http://gracegives.sddev.com.au
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| html5 object| Modernizr function| $ function| jQuery

0 Cookies