ci-ti-bank-online.com

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 166.62.74.194, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is ci-ti-bank-online.com.

This is the only time ci-ti-bank-online.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	166.62.74.194 166.62.74.194	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
1	104.111.239.33 104.111.239.33	16625 (AKAMAI-AS) (AKAMAI-AS)
6	3

4 166.62.74.194 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-74-194.ip.secureserver.net

ci-ti-bank-online.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.239.33 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-33.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ci-ti-bank-online.com ci-ti-bank-online.com	13 KB
1	citi.com online.citi.com	1 KB
1	googleapis.com ajax.googleapis.com	30 KB
6	3

	Domain	Requested by
4	ci-ti-bank-online.com	ci-ti-bank-online.com
1	online.citi.com	ci-ti-bank-online.com
1	ajax.googleapis.com	ci-ti-bank-online.com
6	3

This site contains links to these domains. Also see Links.

Domain
online.citi.com

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2020-01-07` - `2020-03-31`	3 months	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2018-03-14` - `2020-05-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://ci-ti-bank-online.com/
Frame ID: 5948A2E8B8FB0651EA7718800B38832F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

44 kB
Transfer

136 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/JSO/uidn/RequestUserIDReminder.do
Title: Forgot User ID/Password?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ci-ti-bank-online.com/ 5 KB
2 KB 350ms
319ms Document
text/html 166.62.74.194
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://ci-ti-bank-online.com/
Protocol: HTTP/1.1
Server: 166.62.74.194 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-166-62-74-194.ip.secureserver.net
Software: Apache / PHP/7.2.20
Resource Hash: 697d32f5adce7ad0da26f3bdd8af60916b502941a28bcbf91580c9cedc294df0

Request headers

Host: ci-ti-bank-online.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Tue, 28 Jan 2020 05:08:58 GMT
Server: Apache
X-Powered-By: PHP/7.2.20
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2048
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.css
ci-ti-bank-online.com/css/ 7 KB
2 KB 161ms
160ms Stylesheet
text/css 166.62.74.194
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://ci-ti-bank-online.com/css/style.css
Requested by: Host: ci-ti-bank-online.com
URL: http://ci-ti-bank-online.com/
Protocol: HTTP/1.1
Server: 166.62.74.194 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-166-62-74-194.ip.secureserver.net
Software: Apache /
Resource Hash: 7464338431cd94339d753a7806f1ed437f8a1f76ff7121037f6800d142ce9cbd

Request headers

Referer: http://ci-ti-bank-online.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Tue, 28 Jan 2020 05:08:59 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Oct 2019 00:13:10 GMT
Server: Apache
ETag: "52400f0-1a4a-593f67358f180-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 1879

GET
H/1.1 200
OK font-awesome.css
ci-ti-bank-online.com/css/ 37 KB
8 KB 308ms
293ms Stylesheet
text/css 166.62.74.194
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://ci-ti-bank-online.com/css/font-awesome.css
Requested by: Host: ci-ti-bank-online.com
URL: http://ci-ti-bank-online.com/
Protocol: HTTP/1.1
Server: 166.62.74.194 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-166-62-74-194.ip.secureserver.net
Software: Apache /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Referer: http://ci-ti-bank-online.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Tue, 28 Jan 2020 05:08:59 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Apr 2019 17:21:50 GMT
Server: Apache
ETag: "52400f1-9226-586d13cce6780-gzip"
Vary: Accept-Encoding,User-Agent
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5
Content-Length: 7439

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: ci-ti-bank-online.com
URL: http://ci-ti-bank-online.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://ci-ti-bank-online.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Thu, 23 Jan 2020 01:36:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 444758
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Thu, 25 Jan 2018 15:33:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jan 2021 01:36:20 GMT

GET
H/1.1 200
OK Citi.png
ci-ti-bank-online.com/images/ 1 KB
1 KB 314ms
300ms Image
image/png 166.62.74.194
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ci-ti-bank-online.com/images/Citi.png
Requested by: Host: ci-ti-bank-online.com
URL: http://ci-ti-bank-online.com/
Protocol: HTTP/1.1
Server: 166.62.74.194 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-166-62-74-194.ip.secureserver.net
Software: Apache /
Resource Hash: 7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Request headers

Referer: http://ci-ti-bank-online.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Tue, 28 Jan 2020 05:08:59 GMT
Last-Modified: Fri, 27 Sep 2019 00:30:42 GMT
Server: Apache
ETag: "5240100-410-5937dff00f080"
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=5
Content-Length: 1040

GET
H2 200 errorLogo.svg
online.citi.com/GFC/branding/img/ 1 KB
1 KB 222ms
163ms Image
image/svg+xml 104.111.239.33
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/errorLogo.svg

Requested by

Host: ci-ti-bank-online.com
URL: http://ci-ti-bank-online.com/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

f9bd92ac3e3a127d29f3f9786e6233961312cd256b895975cb5dce2f363916e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: http://ci-ti-bank-online.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 24 Apr 2018 15:26:47 GMT
x-akamai-citisite: GTDC
date: Tue, 28 Jan 2020 05:08:59 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
content-length: 584
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
ci-ti-bank-online.com
online.citi.com
104.111.239.33
166.62.74.194
2a00:1450:4001:81c::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
697d32f5adce7ad0da26f3bdd8af60916b502941a28bcbf91580c9cedc294df0
7464338431cd94339d753a7806f1ed437f8a1f76ff7121037f6800d142ce9cbd
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
f9bd92ac3e3a127d29f3f9786e6233961312cd256b895975cb5dce2f363916e8

ci-ti-bank-online.com Open in urlscan Pro 166.62.74.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

33 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

44 kBTransfer

136 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

ci-ti-bank-online.com Open in urlscan Pro
166.62.74.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

44 kB
Transfer

136 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!