www.gicbet.com
Open in
urlscan Pro
47.90.202.206
Malicious Activity!
Public Scan
URL:
http://www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/
Submission: On December 18 via manual from PL
Submission: On December 18 via manual from PL
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 9 HTTP transactions.
The main IP is 47.90.202.206, located in
San Mateo, United States and
belongs to CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN.
The main domain is www.gicbet.com.
This is the only time www.gicbet.com was scanned on urlscan.io!
This is the only time www.gicbet.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 47.90.202.206 47.90.202.206 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
| 9 | 1 |
9
47.90.202.206
(San Mateo, United States)
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
| www.gicbet.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
gicbet.com
www.gicbet.com |
604 KB |
| 9 | 1 |
| Domain | Requested by | |
|---|---|---|
| 9 | www.gicbet.com |
www.gicbet.com
|
| 9 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.ingbank.pl |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/
Frame ID: 1C006A1C6CDC8A3A3898EB351550F4B4
Requests: 9 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
URL: http://www.ingbank.pl/problemy-z-logowaniem
Title: Mam problemy z logowaniemotwiera się w nowym oknieProblemy z logowaniem
Title: Mam problemy z logowaniemotwiera się w nowym oknieProblemy z logowaniem
Search URL Search Domain Scan URL
URL: https://www.ingbank.pl/aktywacja
Title: Aktywuj dostęp
Title: Aktywuj dostęp
Search URL Search Domain Scan URL
URL: https://www.ingbank.pl/bezpieczenstwo
Title: O bezpieczeństwie otwiera się w nowym oknie
Title: O bezpieczeństwie otwiera się w nowym oknie
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/ |
448 KB 158 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
2 MB 220 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
template.css
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
891 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ing-logo.svg
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/assets/images/ |
564 B 564 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log.svg
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
22 KB 22 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1117699.jpg
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
202 KB 202 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
97205b19383b6a85ef38eb0997c23c35.woff2
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
9531ef579ed5b9569b6ed482aa1f297a.woff
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
7c4569f098ee8d97a4c43d72bdefc1eb.ttf
www.gicbet.com/twentynine/languages/mon-comptes/sl2ic2efqnnc77v828/web/content/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.gicbet.com
47.90.202.206
0b52c5338af355699530a47683420e48c7344e779d3e815ff9943cbfdc153cf2
8a2b8f7c90939288f10176bfecfbe536e29422571e693c30afb51885b0ef6466
98ecbb084036cc630779abda7f53d94834ca80ee584790f0a7dc97ed49e356c2
be70436a89f98a3c1a5f619e5bc8cd9708b1b713346f8fabbc97c0c3b73c653d
d3f30a678bb49bae5cb14123e3d03963c9b4cb6e09b6a780b695fb07c465e312
d92cd709594a3f11bf8bd803b57d765069d08bd8e8f8543ad0311652868a4061