www.ceviv.com
Open in
urlscan Pro
195.78.200.71
Malicious Activity!
Public Scan
URL:
https://www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/?...
Submission: On August 08 via automatic, source openphish — Scanned from IT
Submission: On August 08 via automatic, source openphish — Scanned from IT
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 195.78.200.71, located in
Roncone, Italy and
belongs to AS-IRIDEOS-MC, IT.
The main domain is www.ceviv.com.
TLS certificate: Issued by RapidSSL Global TLS RSA4096 SHA256 20... on May 27th 2022. Valid for: a year.
This is the only time www.ceviv.com was scanned on urlscan.io!
TLS certificate: Issued by RapidSSL Global TLS RSA4096 SHA256 20... on May 27th 2022. Valid for: a year.
This is the only time www.ceviv.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 195.78.200.71 195.78.200.71 | 5396 (AS-IRIDEO...) (AS-IRIDEOS-MC) | |
| 1 | 2606:4700:303... 2606:4700:3032::ac43:a9f7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 12 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
ceviv.com
www.ceviv.com |
71 KB |
| 1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 951 |
12 KB |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | www.ceviv.com |
www.ceviv.com
|
| 1 | use.fontawesome.com |
www.ceviv.com
|
| 12 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.ceviv.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2022-05-27 - 2023-06-16 |
a year | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-06 - 2023-06-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/?Key=8d4fe8aa46f6920fb383effce43bfc0d&rand=19lnboxLightespn_8d4fe8aa46f6920fb383effce43bfc0d_Qm1EUkJoNGxkY01vd0t3all0-&df1be92a02fcf4ec1d7d9a4d3713795511ab655fca8a7952903bda66bff93a88=
Frame ID: C5141D3EACEDB50F7D4F6D99D948768F
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
EDD Debit Card - Sign InDetected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wp-(?:content|includes)/
ZURB Foundation
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/ |
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/css/ |
290 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
site.css
www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/css/ |
65 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.css
use.fontawesome.com/releases/v5.7.0/css/ |
53 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
EmailLogo.png
www.ceviv.com/wp-includes/js/jquery/officerabo/eddca/eddca/hjyuio8ikujygrfd/8d4fe8aa46f6920fb383effce43bfc0d/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Regular-webfont.woff
www.ceviv.com/Content/_Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Connections.woff
www.ceviv.com/content/PRC384/_Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Bold-webfont.woff
www.ceviv.com/Content/_Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Bold-webfont.ttf
www.ceviv.com/Content/_Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
OpenSans-Regular-webfont.ttf
www.ceviv.com/Content/_Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Connections.ttf
www.ceviv.com/content/PRC384/_Fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
use.fontawesome.com
www.ceviv.com
195.78.200.71
2606:4700:3032::ac43:a9f7
131fcc62927b7d849dceaf4d79ce4edef0df3498785a4f1930f3c414133cb22d
9ac51812f3c5052b6c14281e132a55b2c5603b4170e8440cca32ebbff26fe866
ad62eb85667532488d032273c196c7ea1c10e0897223c4b66cd38b8c5e5215a4
afdc6bf2de981ffd7d370b76f44e7580572f197efbe214b9cfa4005d189d8eae
db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb
e2a4116657edf8836f2580e1b3ab51dc5e69b23bf6fba69f628f511c34a0e7f6