sigmek.com
Open in
urlscan Pro
96.125.163.12
Malicious Activity!
Public Scan
Submitted URL: http://arquivohistorico.uruguaiana.rs.gov.br/online.php
Effective URL: https://sigmek.com/account-verification/
Submission: On November 10 via manual from PH
Effective URL: https://sigmek.com/account-verification/
Submission: On November 10 via manual from PH
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 14 HTTP transactions.
The main IP is 96.125.163.12, located in
Houston, United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is sigmek.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 16th 2020. Valid for: 3 months.
This is the only time sigmek.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on October 16th 2020. Valid for: 3 months.
This is the only time sigmek.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Metrobank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 177.36.44.69 177.36.44.69 | 262907 (AVATO TEC...) (AVATO TECNOLOGIA) | |
| 2 13 | 96.125.163.12 96.125.163.12 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 14 | 3 |
1
177.36.44.69
(Uruguaiana, Brazil)
ASN262907 (AVATO TECNOLOGIA, BR)
PTR: mail.uruguaiana.rs.gov.br
ASN262907 (AVATO TECNOLOGIA, BR)
PTR: mail.uruguaiana.rs.gov.br
| arquivohistorico.uruguaiana.rs.gov.br |
13
96.125.163.12
(Houston, United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 96-125-163-12.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 96-125-163-12.unifiedlayer.com
| sigmek.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
sigmek.com
2 redirects
sigmek.com |
148 KB |
| 1 |
uruguaiana.rs.gov.br
arquivohistorico.uruguaiana.rs.gov.br |
508 B |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 14 | 3 |
| Domain | Requested by | |
|---|---|---|
| 13 | sigmek.com |
2 redirects
sigmek.com
|
| 1 | arquivohistorico.uruguaiana.rs.gov.br | |
| 0 | Failed |
sigmek.com
|
| 14 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| personal.metrobankdirect.com |
| www.metrobank.com.ph |
| www.globalsign.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.nutriamine.organicoslim.com Let's Encrypt Authority X3 |
2020-10-16 - 2021-01-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sigmek.com/account-verification/
Frame ID: 31E46C05484889BD388984F2D3226D53
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://arquivohistorico.uruguaiana.rs.gov.br/online.php Page URL
-
https://sigmek.com/login/x/session
HTTP 302
https://sigmek.com/account-verification HTTP 301
https://sigmek.com/account-verification/ Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
URL: https://personal.metrobankdirect.com/RetailInternetPortal/enrollment.do#b
Title: Sign Up now!
Title: Sign Up now!
Search URL Search Domain Scan URL
URL: https://personal.metrobankdirect.com/RetailInternetPortal/forgotuseridpassword.do?method=unspecified&pageFrom=forgotUserId&MYCAL=989459af0f906eb4bfebc76933797e726d1ea428#b
Title: Forgot your User ID?
Title: Forgot your User ID?
Search URL Search Domain Scan URL
URL: https://personal.metrobankdirect.com/RetailInternetPortal/forgotuseridpassword.do?method=unspecified&pageFrom=forgotPassword&MYCAL=cc2857ee8c408476af015ca4b68e0735c603872c#b
Title: Forgot your Password?
Title: Forgot your Password?
Search URL Search Domain Scan URL
URL: https://www.metrobank.com.ph/security_center.asp
Title: Security Center
Title: Security Center
Search URL Search Domain Scan URL
URL: https://www.globalsign.com/en-ph/ssl/
Search URL Search Domain Scan URL
URL: https://www.metrobank.com.ph/privacy_policy.asp
Title: Privacy Policy
Title: Privacy Policy
Search URL Search Domain Scan URL
URL: https://www.metrobank.com.ph/terms_of_use.asp
Title: Terms & Conditions
Title: Terms & Conditions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://arquivohistorico.uruguaiana.rs.gov.br/online.php Page URL
-
https://sigmek.com/login/x/session
HTTP 302
https://sigmek.com/account-verification HTTP 301
https://sigmek.com/account-verification/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://sigmek.com/account-verification/js/jquery-v2.js HTTP 302
- net://:ERR_CONNECTION_REFUSED
- https://sigmek.com/account-verification/img/metrobank-logo.png HTTP 302
- net://:ERR_CONNECTION_REFUSED
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
online.php
arquivohistorico.uruguaiana.rs.gov.br/ |
291 B 508 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
sigmek.com/account-verification/ Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
reset.css
sigmek.com/account-verification/css/ |
1 KB 727 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
sigmek.com/account-verification/css/ |
31 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-v1.7.1.js
sigmek.com/account-verification/js/ |
92 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
:ERR_CONNECTION_REFUSED
/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jsencrypt.min.js
sigmek.com/account-verification/js/ |
56 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
sigmek.com/account-verification/js/ |
82 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
:ERR_CONNECTION_REFUSED
/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mb-personal-PNG.png
sigmek.com/account-verification/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
view-demo.png
sigmek.com/account-verification/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
siteseal.PNG
sigmek.com/account-verification/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-bg.png
sigmek.com/account-verification/img/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
button-bg-login.png
sigmek.com/account-verification/img/ |
180 B 209 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Metrobank (Banking)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery object| JSEncryptExports function| JSEncrypt object| KJUR object| Hex object| Base64 function| ASN1 function| resetdata function| connectToOnlineDemo object| _0xda77 function| loginx1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| sigmek.com/ | Name: PHPSESSID Value: 8c9957fe68ece7698bbf700b7601983d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
arquivohistorico.uruguaiana.rs.gov.br
sigmek.com
177.36.44.69
96.125.163.12
03f09f6f24e3f2e7806a4e54659ebae4830f1ec2759149126e8bff020764cd72
147e4ac682c6c3eec99db549605f60e847b240a4578c0fe58f78232081b37440
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
5309ca3e99da2e0fa0de2575ea750847db37fd4f4f1dbbda2a513268c702ace3
7c9412acd14c2af021ca2ef9e181a1cd40840b1ad983210a88bc551669f61b8b
87365418a4de7a71c2ea5750e9fc23b1a6f71455840617f65346979b1691a09c
94ec71a783e5461772334f1a7ff1d05a1a672c89c712bbccdd9e79eeabd66b8f
a0461dff82b1b396bd12e3d7945ff362d51d87f4b5d477d7da56f41c4ce7f544
a5d2ce66efae0fde2f825b3dc79ebcd06d67c8e6d3340c6d20a8f81fb77440c2
c0d00a43b4f97120bdd434da2bb1320d64c8b635ee9ed07adf710d8d3400f862
c2ca3ab2adca3e4ba4736cba9bd3cf672ce80d74fdcff565e27b00de7e127ae1
f9becab173013c632f7909a966c124fccbd7e57d76c4f5c232d3f21ed632aac7