web.ncf.ca - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 172.83.172.13, located in Ottawa, Canada and belongs to NCF-ASN-01, CA. The main domain is web.ncf.ca.
TLS certificate: Issued by R3 on June 24th 2023. Valid for: 3 months.

This is the only time web.ncf.ca was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: TSB Bank (Banking) Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	89.46.109.32 89.46.109.32	31034 (ARUBA-ASN) (ARUBA-ASN)
6	172.83.172.13 172.83.172.13	397168 (NCF-ASN-01) (NCF-ASN-01)
7	2

1 89.46.109.32 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: webx1361.aruba.it

www.ncctravelandgo.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.83.172.13 (Ottawa, Canada)

ASN397168 (NCF-ASN-01, CA)
PTR: www3.ncf.ca

web.ncf.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	ncf.ca web.ncf.ca	152 KB
1	ncctravelandgo.it www.ncctravelandgo.it	403 B
7	2

	Domain	Requested by
6	web.ncf.ca	www.ncctravelandgo.it web.ncf.ca
1	www.ncctravelandgo.it
7	2

This site contains no links.

Subject Issuer	Validity	Valid
*.ncf.ca R3	`2023-06-24` - `2023-09-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu
Frame ID: 7AF58D01B93EE9CC236D1DFC9102ABDD
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

http://www.ncctravelandgo.it/administrator/login.php Page URL
https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/index.php Page URL
https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

153 kB
Transfer

179 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.ncctravelandgo.it/administrator/login.php Page URL
https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/index.php Page URL
https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK login.php
www.ncctravelandgo.it/administrator/ 155 B
403 B 174ms
132ms Document
text/html 89.46.109.32
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ncctravelandgo.it/administrator/login.php
Protocol: HTTP/1.1
Server: 89.46.109.32 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: webx1361.aruba.it
Software: aruba-proxy /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 15 Aug 2023 09:44:14 GMT
Server: aruba-proxy
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-ServerName: ipvsproxy181.ad.aruba.it

GET
H2 200 index.php Show response
web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/ 563 B
812 B 722ms
387ms Document
text/html 172.83.172.13
NCF-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL

https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/index.php

Requested by

Host: www.ncctravelandgo.it
URL: http://www.ncctravelandgo.it/administrator/login.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

172.83.172.13 Ottawa, Canada, ASN397168 (NCF-ASN-01, CA),

Reverse DNS

www3.ncf.ca

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

926167b32e1afb3908c75a786d11b9785e380752759f0e41329029d058267ad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://www.ncctravelandgo.it/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-length: 467
content-type: text/html; charset=UTF-8
date: Tue, 15 Aug 2023 09:44:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: unsafe-url
server: nginx/1.14.0 (Ubuntu)
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
H2 200 soa.js Show response
web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/ 20 KB
6 KB 135ms
135ms Script
application/javascript 172.83.172.13
NCF-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL

https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/soa.js

Requested by

Host: web.ncf.ca
URL: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/index.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

172.83.172.13 Ottawa, Canada, ASN397168 (NCF-ASN-01, CA),

Reverse DNS

www3.ncf.ca

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 09:44:15 GMT
content-encoding: gzip
referrer-policy: unsafe-url
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 15 Aug 2023 09:44:15 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"4f65-602f4dda33380-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 6049

GET
H2 200 Primary Request Login.php Show response
web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/ 2 KB
2 KB 308ms
308ms Document
text/html 172.83.172.13
NCF-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL

https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu

Requested by

Host: www.ncctravelandgo.it
URL: http://www.ncctravelandgo.it/administrator/login.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

172.83.172.13 Ottawa, Canada, ASN397168 (NCF-ASN-01, CA),

Reverse DNS

www3.ncf.ca

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

afbeb5f3f18910c89ca0939a63ef0d098cae5a9f31b565e15e2edf1513f83849

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/index.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-length: 1283
content-type: text/html; charset=UTF-8
date: Tue, 15 Aug 2023 09:44:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: unsafe-url
server: nginx/1.14.0 (Ubuntu)
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
H2 200 soa.js Show response
web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/ 20 KB
6 KB 137ms
136ms Script
application/javascript 172.83.172.13
NCF-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL

https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/soa.js

Requested by

Host: web.ncf.ca
URL: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

172.83.172.13 Ottawa, Canada, ASN397168 (NCF-ASN-01, CA),

Reverse DNS

www3.ncf.ca

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 09:44:15 GMT
content-encoding: gzip
referrer-policy: unsafe-url
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Tue, 15 Aug 2023 09:44:15 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"4f65-602f4dda33380-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 6049

GET
H2 200 continue.png
web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/assets/img/ 1 KB
2 KB 134ms
133ms Image
image/png 172.83.172.13
NCF-ASN-01

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/assets/img/continue.png

Requested by

Host: web.ncf.ca
URL: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

172.83.172.13 Ottawa, Canada, ASN397168 (NCF-ASN-01, CA),

Reverse DNS

www3.ncf.ca

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

618b0e96c6bf41f64cb14c9c32219f278311936e6cf5a7ba832230389db3ccb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 09:44:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: unsafe-url
last-modified: Tue, 15 Aug 2023 09:44:16 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"5a6-602f4dda33380"
content-type: image/png
accept-ranges: bytes
content-length: 1446

GET
H2 200 1.png
web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/ 135 KB
136 KB 135ms
135ms Image
image/png 172.83.172.13
NCF-ASN-01

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/1.png

Requested by

Host: web.ncf.ca
URL: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

172.83.172.13 Ottawa, Canada, ASN397168 (NCF-ASN-01, CA),

Reverse DNS

www3.ncf.ca

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d22a8fec25e0f44176ac92b1b8adeb7e3a1222be1f0fdb8b7382c02800252d08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://web.ncf.ca/fh448/novels/Mobi-format-no-graphics/TSB/TSB/Login.php?sslchannel=true&form=AccountVerification&sessionid=AccbnirC3UcCLC47Seq4e35Q3w65qus0HFb4XDH1yUEjwIrpXRtbVz1Y583vDwwkbIp9l7aU2PdyxFYu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 09:44:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: unsafe-url
last-modified: Tue, 15 Aug 2023 09:44:16 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"21d66-602f4dd84af00"
content-type: image/png
accept-ranges: bytes
content-length: 138598

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TSB Bank (Banking) Generic (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			web.ncf.ca/	1969-12-31 23:59:59	Name: PHPSESSID Value: c5emlfvaj3qrrpibgf5kkintm0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

web.ncf.ca
www.ncctravelandgo.it
172.83.172.13
89.46.109.32
618b0e96c6bf41f64cb14c9c32219f278311936e6cf5a7ba832230389db3ccb0
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
926167b32e1afb3908c75a786d11b9785e380752759f0e41329029d058267ad6
afbeb5f3f18910c89ca0939a63ef0d098cae5a9f31b565e15e2edf1513f83849
d22a8fec25e0f44176ac92b1b8adeb7e3a1222be1f0fdb8b7382c02800252d08

web.ncf.ca Open in urlscan Pro 172.83.172.13 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

153 kBTransfer

179 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

web.ncf.ca Open in urlscan Pro
172.83.172.13 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

153 kB
Transfer

179 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!