servj.ga
Open in
urlscan Pro
2606:4700:30::681b:9692
Malicious Activity!
Public Scan
Submission: On May 20 via manual from US
Summary
This is the only time servj.ga was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Permanent TSB (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2606:4700:30:... 2606:4700:30::681b:9692 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2606:4700:30:... 2606:4700:30::681b:9792 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
12 | 193.120.216.23 193.120.216.23 | 2110 (AS-BTIRE ...) (AS-BTIRE BT Ireland was previously known as Esat Net) | |
16 | 5 |
ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com |
ASN2110 (AS-BTIRE BT Ireland was previously known as Esat Net, EUnet Ireland & IEUnet., IE)
www.open24.ie |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
open24.ie
www.open24.ie |
747 KB |
3 |
servj.ga
1 redirects
servj.ga |
6 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
25 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
16 | 4 |
Domain | Requested by | |
---|---|---|
12 | www.open24.ie |
servj.ga
www.open24.ie |
3 | servj.ga |
1 redirects
servj.ga
|
1 | www.googletagmanager.com |
servj.ga
|
0 | www.open24.iehttps Failed |
servj.ga
|
16 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.permanenttsb.ie |
www.open24.ie |
twitter.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
www.open24.ie DigiCert SHA2 Secure Server CA |
2018-12-13 - 2020-01-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://servj.ga/open24/
Frame ID: 407E4C3571B093AA61606A538A2F52D6
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://servj.ga/open24
HTTP 301
http://servj.ga/open24/ Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
- env /^google_tag_manager$/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- env /^Modernizr$/i
SWFObject (Miscellaneous) Expand
Detected patterns
- env /^SWFObject$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: Learn more about cookies
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Forgot your password?
Search URL Search Domain Scan URL
Title: logging in / registering
Search URL Search Domain Scan URL
Title: technical issues
Search URL Search Domain Scan URL
Title: security concerns
Search URL Search Domain Scan URL
Title: +353 1 2124101
Search URL Search Domain Scan URL
Title: Learn more about PSD2, Third Party Providers and access to your accounts.
Search URL Search Domain Scan URL
Title: Learn more about keeping your account secure
Search URL Search Domain Scan URL
Title: @askpermanenttsb
Search URL Search Domain Scan URL
Title: contact us
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://servj.ga/open24
HTTP 301
http://servj.ga/open24/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
servj.ga/open24/ Redirect Chain
|
19 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtm5445.html
servj.ga/www.googletagmanager.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
64 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
redirection_mobile.min.js
www.open24.ie/online/js/base/ |
2 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style
www.open24.ie/online/css/ |
193 KB 194 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr
www.open24.ie/online/js/libraries/ |
12 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
logo.png
www.open24.iehttps//www.open24.ie/online/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.open24.ie/online/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.min.js
www.open24.ie/online/js/base/libraries/ |
85 KB 85 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utils
www.open24.ie/online/js/ |
926 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app_plugins
www.open24.ie/online/js/ |
330 KB 331 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clearlocalstorage
www.open24.ie/online/js/ |
20 B 377 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ganalytics
www.open24.ie/online/js/ |
938 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.png
www.open24.ie/online/img/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
34 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-overlay.png
www.open24.ie/online/img/ |
57 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.png
www.open24.ie/online/img/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.open24.iehttps
- URL
- https://www.open24.iehttps//www.open24.ie/online/img/logo.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Permanent TSB (Banking)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| dataLayer function| gtag object| google_tag_manager object| SA string| mobile_redirect object| redirect object| html5 object| Modernizr function| yepnope function| $ function| jQuery boolean| clicked function| FastClick object| ZeroClipboard_TableTools function| TableTools object| swfobject object| Downloadify object| BROWSER object| TSB0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
servj.ga
www.googletagmanager.com
www.open24.ie
www.open24.iehttps
www.open24.iehttps
193.120.216.23
2606:4700:30::681b:9692
2606:4700:30::681b:9792
2a00:1450:4001:81e::2008
128bfa12addc3d4b8abf45a8d1b00586799609215a0f996f2430a32656d15b5b
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1daf3ae375d7fddc76d200833766842061f35d337a70f6af0c713bd9b98e7f39
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1efad86a4518dbf1b080bbc574d77f3e04d5cdf65f88fb12e4e443b64c9a94c8
20640f26d130ad057a2222e3d2904c52089c58033fa473ef4c7055392bf34655
26d969975f59caebddd1e076b9db58e3c980d46034b7a1a63fac2cb42277a79c
4a4d8beea6c52b67f2a766fa3b1b27c8d17564f034bf379e52ad372c39fcc68c
98c96e551690e6974d04209eccfbb9fccda31c4034f05c1e5bff83c312c11620
9e7956aaa3fd23a37639939bdb89431661dde3186ffb5ca54ba1f4e34999c2bb
b312a9f67a06d9f95db2239633cc6f5607a484f0d333f6316c3547dd62650967
c769665aa1cab2a4c3aeaeb1f5283b2a4a461a288b314e79fb7148bc57712e64
ce0b28cde1675780f6b254f38d6e2e180a4f452141dc80223354c3b106542fbe
d3d1e39083bc6c9bdb12c33e070d33931af4f27831d433f60c6ce6d0ff95f3e1
eec808eb5f0de8bff9a1317b09b5100dc8e5a04213e23b38478588f0f2039b1d