plusonetec.com Open in urlscan Pro
153.122.9.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://plusonetec.com/347r/3fw90je/lo.php
Submission: On March 22 via api (March 22nd 2017, 12:36:53 am UTC) from CA

Summary HTTP 8 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 153.122.9.3, located in Tokyo, Japan and belongs to ACROSS Dream Wave Shizuoka Co. Ltd., JP. The main domain is plusonetec.com.

This is the only time plusonetec.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	153.122.9.3 153.122.9.3	18068 (ACROSS Dr...) (ACROSS Dream Wave Shizuoka Co. Ltd.)
1	171.161.202.200 171.161.202.200	10794 (BANKAMERICA) (BANKAMERICA - Bank of America)
8	3

2 153.122.9.3 (Tokyo, Japan)

ASN18068 (ACROSS Dream Wave Shizuoka Co. Ltd., JP)
PTR: ac.ptr54.ptrcloud.net

plusonetec.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 171.161.202.200 (Concord, United States)

ASN10794 (BANKAMERICA - Bank of America, US)

secure.bankofamerica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	plusonetec.com plusonetec.com	20 KB
1	bankofamerica.com secure.bankofamerica.com Failed streak.bankofamerica.com Failed pane.bankofamerica.com Failed www.bankofamerica.com Failed	12 KB
8	2

	Domain	Requested by
2	plusonetec.com	plusonetec.com
1	secure.bankofamerica.com	plusonetec.com
0	www.bankofamerica.com Failed	secure.bankofamerica.com
0	pane.bankofamerica.com Failed	plusonetec.com
0	streak.bankofamerica.com Failed	plusonetec.com
8	5

This site contains links to these domains. Also see Links.

Domain
secure.bankofamerica.com
www.bankofamerica.com

Subject Issuer	Validity	Valid
secure.bankofamerica.com Symantec Class 3 EV SSL CA - G3	`2016-10-21` - `2017-10-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://plusonetec.com/347r/3fw90je/lo.php
Frame ID: 1823.1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

8
Requests

13 %
HTTPS

0 %
IPv6

2
Domains

5
Subdomains

3
IPs

2
Countries

33 kB
Transfer

57 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://secure.bankofamerica.com/login/languageToggle.go?request_locale=es-us
Title: En Español

Search URL Search Domain Scan URL

URL: https://secure.bankofamerica.com/login/sign-in/redirectAction.go?screen=RESET_ID&requestLocalePassed=en-us
Title: reset it now

Search URL Search Domain Scan URL

URL: https://secure.bankofamerica.com/login/enroll/entry/olbEnroll.go?reason=model_enroll
Title: Enroll now

Search URL Search Domain Scan URL

URL: https://www.bankofamerica.com/onlinebanking/learning-center.go
Title: Learn more about Online Banking

Search URL Search Domain Scan URL

URL: https://www.bankofamerica.com/online-banking/service-agreement.go
Title: Service Agreement

Search URL Search Domain Scan URL

URL: https://www.bankofamerica.com/privacy/
Title: Privacy & Security

Search URL Search Domain Scan URL

URL: http://www.bankofamerica.com/help/equalhousing_popup.cfm
Title: Equal Housing Lender

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request lo.php Show response plusonetec.com/347r/3fw90je/	17 KB 17 KB	617ms 351ms	Document text/html	153.122.9.3 ACROSS Dream Wave...
General Check archive.org Show headers Download Go to Full URL http://plusonetec.com/347r/3fw90je/lo.php Protocol HTTP/1.1 Server 153.122.9.3 Tokyo, Japan, ASN18068 (ACROSS Dream Wave Shizuoka Co. Ltd., JP), Reverse DNS ac.ptr54.ptrcloud.net Software Apache / PleskLin Resource Hash `b55ed955c3dbbe4b98916605781b3d8c0a23efc9d08f6810741e83e283fa587f` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host plusonetec.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Wed, 22 Mar 2017 00:36:40 GMT Server Apache Connection close X-Powered-By PleskLin Transfer-Encoding chunked Content-Type text/html
GET		vipaa-login-jawr.css secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/2.1/style/	0 0

GET		vipaa-login-jawr.js secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/2.1/script/	0 0

GET H/1.1	200 OK	bac_reg_logo_tmp_250X69.gif plusonetec.com/347r/3fw90je/files/	4 KB 4 KB	563ms 281ms	Image image/gif	153.122.9.3 ACROSS Dream Wave...
General Check archive.org Show headers Download Go to Show image Full URL http://plusonetec.com/347r/3fw90je/files/bac_reg_logo_tmp_250X69.gif Requested by Host: plusonetec.com URL: http://plusonetec.com/347r/3fw90je/lo.php Protocol HTTP/1.1 Server 153.122.9.3 Tokyo, Japan, ASN18068 (ACROSS Dream Wave Shizuoka Co. Ltd., JP), Reverse DNS ac.ptr54.ptrcloud.net Software Apache / PleskLin Resource Hash `0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host plusonetec.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://plusonetec.com/347r/3fw90je/lo.php Connection keep-alive Cache-Control no-cache Referer http://plusonetec.com/347r/3fw90je/lo.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Wed, 22 Mar 2017 00:36:41 GMT ETag "15c05c-e0c-4f1f4c7d85380" Last-Modified Sun, 09 Feb 2014 08:12:14 GMT Server Apache X-Powered-By PleskLin Content-Type image/gif Connection close Accept-Ranges bytes Content-Length 3596
GET H/1.1	200 OK	cm-jawr.js Show response secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/2.1/script/	37 KB 12 KB	1027ms 379ms	Script application/x-javascript	171.161.202.200 Bank of America
General Check archive.org Show headers Download Go to Full URL https://secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/2.1/script/cm-jawr.js Requested by Host: plusonetec.com URL: http://plusonetec.com/347r/3fw90je/lo.php Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 171.161.202.200 Concord, United States, ASN10794 (BANKAMERICA - Bank of America, US), Reverse DNS Software / Resource Hash `4896569a07934b21f89a3f1c86f17633013e448efda98aa0604af941d3503ea2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host secure.bankofamerica.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://plusonetec.com/347r/3fw90je/lo.php Connection keep-alive Cache-Control no-cache Referer http://plusonetec.com/347r/3fw90je/lo.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Wed, 22 Mar 2017 00:36:42 GMT Content-Encoding gzip Last-Modified Wed, 08 Feb 2017 17:28:20 GMT Age 0 ETag "315c-5480830d8b500" X-BOA-RequestID vRzJT6dGgicABSjXq3gAAAGJ X-Serviced-By ioR0CzSYHxenXHOm2aUmgw==--wd9Cf3PnXDCRvMm+Sbtu2A== Content-Type application/x-javascript Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=485 Content-Length 12636 Expires Thu, 22 Mar 2018 00:36:42 GMT
GET		I3n.js streak.bankofamerica.com/30306/	0 0

GET		a8e.js pane.bankofamerica.com/30306/	0 0

GET		tc_logging.js www.bankofamerica.com/pa/global-assets/external/tc/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: secure.bankofamerica.com
URL: https://secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/2.1/style/vipaa-login-jawr.css

Domain: secure.bankofamerica.com
URL: https://secure.bankofamerica.com/pa/components/bundles/gzip-compressed/xengine/VIPAA/2.1/script/vipaa-login-jawr.js

Domain: streak.bankofamerica.com
URL: http://streak.bankofamerica.com/30306/I3n.js

Domain: pane.bankofamerica.com
URL: http://pane.bankofamerica.com/30306/a8e.js

Domain: www.bankofamerica.com
URL: https://www.bankofamerica.com/pa/global-assets/external/tc/tc_logging.js?

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pane.bankofamerica.com
plusonetec.com
secure.bankofamerica.com
streak.bankofamerica.com
www.bankofamerica.com
pane.bankofamerica.com
secure.bankofamerica.com
streak.bankofamerica.com
www.bankofamerica.com
153.122.9.3
171.161.202.200
0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72
4896569a07934b21f89a3f1c86f17633013e448efda98aa0604af941d3503ea2
b55ed955c3dbbe4b98916605781b3d8c0a23efc9d08f6810741e83e283fa587f

plusonetec.com Open in urlscan Pro 153.122.9.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

8 Requests

13 %HTTPS

0 %IPv6

2 Domains

5 Subdomains

3 IPs

2 Countries

33 kBTransfer

57 kBSize

0 Cookies

7 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

plusonetec.com Open in urlscan Pro
153.122.9.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

13 %
HTTPS

0 %
IPv6

2
Domains

5
Subdomains

3
IPs

2
Countries

33 kB
Transfer

57 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!