sushienmexicali.com
Open in
urlscan Pro
67.20.115.242
Malicious Activity!
Public Scan
Submitted URL: https://skmn.no/wp-includes/images/redi.php
Effective URL: http://sushienmexicali.com/imagenes/bend/index.php
Submission Tags: 7375525
Submission: On December 07 via api from US — Scanned from DE
Effective URL: http://sushienmexicali.com/imagenes/bend/index.php
Submission Tags: 7375525
Submission: On December 07 via api from US — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 10 HTTP transactions.
The main IP is 67.20.115.242, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is sushienmexicali.com.
This is the only time sushienmexicali.com was scanned on urlscan.io!
This is the only time sushienmexicali.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bendigo Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 185.125.171.16 185.125.171.16 | 56655 (TERRAHOST) (TERRAHOST) | |
| 9 | 67.20.115.242 67.20.115.242 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 10 | 2 |
9
67.20.115.242
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 67-20-115-242.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 67-20-115-242.unifiedlayer.com
| sushienmexicali.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
sushienmexicali.com
sushienmexicali.com |
182 KB |
| 1 |
skmn.no
skmn.no |
270 B |
| 10 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | sushienmexicali.com |
skmn.no
sushienmexicali.com |
| 1 | skmn.no | |
| 10 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.microsoft.com |
| www.google.com |
| www.bendigobank.com.au |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| skmn.no R3 |
2021-10-11 - 2022-01-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://sushienmexicali.com/imagenes/bend/index.php
Frame ID: 5E276CB88FD82D3FEC8EE91CF5F10606
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Bendigo Bank - Logon to e-bankingPage URL History Show full URLs
- https://skmn.no/wp-includes/images/redi.php Page URL
- http://sushienmexicali.com/imagenes/bend/index.php Page URL
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://www.microsoft.com/en-au/download/internet-explorer.aspx
Title: update your browser
Title: update your browser
Search URL Search Domain Scan URL
URL: https://www.google.com/intl/en/chrome/browser/
Title: Google Chrome
Title: Google Chrome
Search URL Search Domain Scan URL
URL: https://www.bendigobank.com.au/help/ebanking/technical-information/supported-browsers/
Title: list of supported browsers in our FAQs
Title: list of supported browsers in our FAQs
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://skmn.no/wp-includes/images/redi.php Page URL
- http://sushienmexicali.com/imagenes/bend/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
redi.php
skmn.no/wp-includes/images/ |
124 B 270 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
index.php
sushienmexicali.com/imagenes/bend/ |
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
site_v6.css
sushienmexicali.com/imagenes/bend/css/ |
18 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
home-loan.png
sushienmexicali.com/imagenes/bend/images/ |
105 KB 106 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-ben_v1.svg
sushienmexicali.com/imagenes/bend/images/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lock_v1.svg
sushienmexicali.com/imagenes/bend/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
itunes.svg
sushienmexicali.com/imagenes/bend/images/ |
19 KB 19 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
google-play-badge.svg
sushienmexicali.com/imagenes/bend/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
proximanova-regular.woff
sushienmexicali.com/imagenes/bend/images/ |
15 KB 15 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
proximanova-semibold.woff
sushienmexicali.com/imagenes/bend/images/ |
15 KB 15 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bendigo Bank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| sushienmexicali.com/ | Name: PHPSESSID Value: fa008a3e3f35c451a049c8a33a1b556a |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
skmn.no
sushienmexicali.com
185.125.171.16
67.20.115.242
128eb4ec91d98fce039ff9bdaa395e4f3c15050e7c78de9494a2fc791dacd935
16ae0de21ae8e4f8e93edf34ba51dbb54a6cb3f632cac7e4dabd08a4477b7834
1f1669cd6d1f1848ab8e33dd877808d5fad310b1455e39e26523cfbf78ddb27f
2cef603909dde61f26c62d596d2862f07c68012fa44a0f2fe443d227b8ed1b0d
3670d133994a82becfc193429b9c62c6f29950818c7b4ce0106acbe3f0f00f03
5cde9ecae2f966bdc03bd4913f806fd802d28fc9f08c09e23326d29cc0f4a29f
72c1c0e78445673fef0a47656ac0c4c69376795b3caac1072261f3325ba3e29e
f73fc9dc8ebb9475c86e0a2017cba8776978d1dc508a83c5464e1859dbfab052
fa73478be9309d85f0f50202ec229415c4a128bf9f3d59b17b0560ed412c84e7