1von.top
Open in
urlscan Pro
103.142.87.156
Malicious Activity!
Public Scan
Effective URL: https://1von.top/commbiz1
Submission Tags: @ecarlesi possiblethreat #phishing #anz_au Search All
Submission: On July 09 via api from AU — Scanned from AU
Summary
TLS certificate: Issued by R3 on July 8th 2023. Valid for: 3 months.
This is the only time 1von.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commonwealth Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 14 | 103.142.87.156 103.142.87.156 | 138152 (YISUCLOUD...) (YISUCLOUDLTD-HK YISU CLOUD LTD) | |
14 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
1von.top
1 redirects
1von.top |
291 KB |
0 |
getclicky.com
Failed
static.getclicky.com Failed |
|
14 | 2 |
Domain | Requested by | |
---|---|---|
14 | 1von.top |
1 redirects
1von.top
|
0 | static.getclicky.com Failed |
1von.top
|
14 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ix7m.top R3 |
2023-07-08 - 2023-10-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://1von.top/commbiz1
Frame ID: 83DBD348951C5FF6AC6E3DB18A436592
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Log on to NetBankPage URL History Show full URLs
-
http://1von.top/
HTTP 301
https://1von.top/ Page URL
- https://1von.top/commbiz1 Page URL
Detected technologies
Laravel (Web Frameworks) ExpandDetected patterns
Vue.js (JavaScript Frameworks) Expand
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://1von.top/
HTTP 301
https://1von.top/ Page URL
- https://1von.top/commbiz1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://1von.top/ HTTP 301
- https://1von.top/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
1von.top/ Redirect Chain
|
13 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
static-styles.css
1von.top/css/ |
2 KB 982 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
1von.top/js/ |
266 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-logo_sml.svg
1von.top/img/ |
17 KB 17 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
101350353.js
static.getclicky.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
commbiz1
1von.top/ |
33 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
1von.top/novue/js/ |
86 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layui.all.js
1von.top/novue/js/layuiadmin/layui/ |
272 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layui.css
1von.top/novue/js/layuiadmin/layui/css/ |
73 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
85.67c7c74f.css
1von.top/css/commbiz/ |
3 KB 840 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NB-Login-SmartMini.2fe75ea7.jpg
1von.top/img/commbiz/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
laydate.css
1von.top/novue/js/layuiadmin/layui/css/modules/laydate/default/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer.css
1von.top/novue/js/layuiadmin/layui/css/modules/layer/default/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
code.css
1von.top/novue/js/layuiadmin/layui/css/modules/ |
1 KB 683 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- static.getclicky.com
- URL
- https://static.getclicky.com/101350353.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commonwealth Bank (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| layui number| errors function| lay object| layer string| id function| next1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
1von.top/ | Name: laravel_session Value: eyJpdiI6InJsRXBKdmpHYTdPTm5oRU1WMmlOOUE9PSIsInZhbHVlIjoibFc5TG1LV2htOUdUeEE5Q25TU01IYTlGZ3ZnSWhUY1lwbnMyYmorR3VlMlE3azJXWThFYmxlWXN2a29oeU9jVWUzSFdMem9LY2ROcldPRHpnaklxTjJUVjA1UlFleEhTMG16VzZLSzlqd2ZCekRtdFBmVGhkOGd6Yk1aaDJlOXEiLCJtYWMiOiI3MzA0MDBlOGYxMThjNjU5NDk2ZjZkMmQ3OGQ5MzFiNzY2ODVlNDA4NTUyZTdjMmFhZTQ3NGI4ZDA2MzRmZWYzIiwidGFnIjoiIn0%3D |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1von.top
static.getclicky.com
static.getclicky.com
103.142.87.156
0030c2dc74a6d515b7978b8a4de0d492c36af04f858f2002cced2a3142376093
07da4bfbc7602fbc1d9b6dbf92b03a6acd29972f9dbfa168a9c8016f0234d605
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
232b4a3a17d7d3c31e1527a611ae1a0238c4d6774825fe6ad30d5b00e254fa56
251a9e596ef2859fb0e92e13b4c619e95a131a93b55e48974552d312c75d9514
26437b94d0f04ca9799425e7db20bb14e17cc9f777fa64b92ad05f87e2fddc21
3eebb6c8549fbebd0a791552f11529a5a3348450978e7a806968f665efa61e43
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820
4caab44b55faac4d09e272ffe13943078236a35195e8e3d6e9afd032b34efdea
4f6db60c1834eb977f3b6f3ea1b3c7bc6c128040920ed3df8bdb1b2dd976cd81
594abaade3d2a64a783626220a51d93843def4aab2132389eeb31a36a46dd667
67e430e31687bbb734a9b4f5f6e6c3c9cfcc51c49ccff5530e508d174c78fbfd
68517f60f810bf6c8a590c0c9bd685fe213605cc925990d7e9bbc88ea180e870
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
89d48027f86713a8521b12109f88ede96deb2c2552b296054d5f22337b468a74
cd4c4518e0684d548e90cf3ee37f04b9ab0b08d04569a8dfd8d97ff1e257d9e8