urlscan.io logo urlscan.io
SecurityTrails logo

stcironline.com Open in urlscan Pro
172.67.183.155  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://stcironline.com/
Effective URL: https://stcironline.com/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On October 11 via api from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 172.67.183.155, located in United States and belongs to CLOUDFLARENET, US. The main domain is stcironline.com.
TLS certificate: Issued by WE1 on October 11th 2024. Valid for: 3 months.
This is the only time stcironline.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spokane Teachers Credit Union (Financial)

Domain & IP information

IP Address AS Autonomous System
5 172.67.183.155 13335 (CLOUDFLAR...)
3 143.204.215.95 16509 (AMAZON-02)
8 2
Apex Domain
Subdomains		 Transfer
5 stcironline.com
stcironline.com
212 KB
3 alkamitech.com
assets.orb.alkamitech.com — Cisco Umbrella Rank: 23371
35 KB
8 2
Domain Requested by
5 stcironline.com stcironline.com
3 assets.orb.alkamitech.com
8 2
Subject Issuer Validity Valid
stcironline.com
WE1		 2024-10-11 -
2025-01-09		 3 months crt.sh
*.orb.alkamitech.com
Entrust Certification Authority - L1K		 2023-11-20 -
2024-11-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://stcironline.com/
Frame ID: 7FA16BD951A303C185710517AE423C4B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Survey

Page URL History Show full URLs

  1. http://stcironline.com/ HTTP 307
    https://stcironline.com/ Page URL

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

247 kB
Transfer

1149 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://stcironline.com/ HTTP 307
    https://stcironline.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
stcironline.com/
Redirect Chain
  • http://stcironline.com/
  • https://stcironline.com/
527 B
824 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stcironline.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.183.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b07a4eb97bba5f847f9fdb780c69ab35f58bf46fcc31ce875d1a6942ccdcbf6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8d12533b9f6ebaaf-MXP
content-encoding
zstd
content-type
text/html
date
Fri, 11 Oct 2024 22:35:45 GMT
last-modified
Fri, 11 Oct 2024 18:49:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r1%2BGbid7y1aI97qX6rFQzrUseKfF0%2B3OtC%2Fmh3fdBXrecQJchfp%2Fc2gXi%2Bjn4Hj0kmb4XNS57GaecL7d5yi8gIgeW5MTtsKoKdR6%2B%2BJErfBfWJtqVqGvnbFoiU6fOO%2BVRtk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"
vary
accept-encoding

Redirect headers

Location
https://stcironline.com/
Non-Authoritative-Reason
HttpsUpgrades
speculation
stcironline.com/cdn-cgi/ 		128 B
474 B 		Other
General
Check archive.org
Download Go to
Full URL
https://stcironline.com/cdn-cgi/speculation
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.183.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://stcironline.com
Referer
https://stcironline.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1GhXZdRlhP8852AtppdKhboRZ5HVZ7z2Esi9Ut9rreW9aD30Sh9fU1gmdq2aRcmrqHZIzt9foM2Rhv7iUi5hcsTMaQ3%2Bar6kvPY49Exat%2BL2DQAzI7WgXH69lWc0e4d579g%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d12533c78acbaaf-MXP
access-control-allow-origin
https://stcironline.com
alt-svc
h3=":443"; ma=86400
content-length
128
date
Fri, 11 Oct 2024 22:35:46 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
main.986d4f1a.js
stcironline.com/static/js/ 		229 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stcironline.com/static/js/main.986d4f1a.js
Requested by
Host: stcironline.com
URL: https://stcironline.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.183.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
326b80681d0f8aae47e678c8ba2e6c9a36e6da8af16b9bc34a797c298a1de818

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://stcironline.com/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
etag
W/"67097326-394f1"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PeKrAGk7i9k%2FLYZj3aUEs2fmzNot19zJo4OJJtgsYUD%2FE9eECo4Aa%2BmzYJ%2FacwxYD5MIP8jxQipU9L3wcT%2BzNP9P56giZP0nI5jNjqsIdxml2vjlBDFFl9ZTEVYflHxdY6s%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d12533c78aabaaf-MXP
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 22:35:46 GMT
content-type
application/javascript
last-modified
Fri, 11 Oct 2024 18:49:10 GMT
vary
Accept-Encoding
server
cloudflare
main.985e6856.css
stcironline.com/static/css/ 		866 KB
137 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stcironline.com/static/css/main.985e6856.css
Requested by
Host: stcironline.com
URL: https://stcironline.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.183.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da902cd08cb79b5cc6b7e5443395644879d6b9e98c7deeeb517537f709fbd36e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://stcironline.com/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
etag
W/"67097326-d8925"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RixgLOCYX5haAu2jFIwBdPnlx4HZUJYA6AiuVToYT6aZplsMrkEjMloUJ%2BK2%2BqzcEEsXMhv9y0EGwv%2Fg9u0Q%2FTn1SwmVIF%2BcTlmVgTOqH8MGMBCy%2FsB8QUnxAqQe%2BtuY%2FWE%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d12533c78a8baaf-MXP
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 22:35:46 GMT
content-type
text/css
last-modified
Fri, 11 Oct 2024 18:49:10 GMT
vary
Accept-Encoding
server
cloudflare
brand-logo-wide.png
assets.orb.alkamitech.com/production/themesets/8054c733-80e7-420c-9007-09a927f36aa3/themes/theme-builder/spokane/assets/images/ 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.orb.alkamitech.com/production/themesets/8054c733-80e7-420c-9007-09a927f36aa3/themes/theme-builder/spokane/assets/images/brand-logo-wide.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-95.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6719def9e2920d84507208579490d15a7395234a61be891f0b1dd1acf988e3de

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://stcironline.com/

Response headers

x-amz-version-id
_RmPXwlkalGr50gywNlYdaap8tBlTz5v
etag
"29d5ed692ee6195a316e38ab14e46a93"
x-cache
RefreshHit from cloudfront
x-amz-cf-id
B44_4ecxjfOwHYsp_0w6fA-b4aPD3nO39XXRycbq8A6jj53uxZ0sPA==
date
Fri, 11 Oct 2024 22:35:48 GMT
content-type
image/png
vary
Accept-Encoding
last-modified
Wed, 26 Jul 2023 17:47:21 GMT
content-disposition
form-data; name="images/brand-logo-wide.png"; filename="images/brand-logo-wide.png"; filename*=utf-8''images%2Fbrand-logo-wide.png
x-amz-replication-status
COMPLETED
cache-control
max-age=3600
via
1.1 86ef89199388021c33b079c598103b12.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
21557
x-amz-cf-pop
FRA53-C1
server
AmazonS3
x-amz-server-side-encryption
AES256
app-store.svg
assets.orb.alkamitech.com/production/assets/themes/images/appLogos/ 		15 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.orb.alkamitech.com/production/assets/themes/images/appLogos/app-store.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-95.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4502ac54aa5ad80661dc06a40ab0be989806881f1a026ec01950b1bbbf118b98

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://stcironline.com/

Response headers

content-encoding
gzip
x-amz-version-id
1NBn5rT5o.IhK7USgujbMSFTmg0HgaDn
etag
"3e159c01c57ee75b89af36133535d2fb"
expires
Mon, 03 Nov 2042 21:03:57 GMT
x-cache
RefreshHit from cloudfront
x-amz-cf-id
9EiwX7WkOxQ0KJhnlNDLizyu60n5AEDyVjZIcYlFfO_QDHEJ79G8Gg==
date
Fri, 11 Oct 2024 22:35:48 GMT
content-type
image/svg+xml
vary
Accept-Encoding
last-modified
Tue, 08 Nov 2022 21:04:00 GMT
x-amz-replication-status
COMPLETED
cache-control
max-age=630720000, no-cache, no-transform, public
via
1.1 86ef89199388021c33b079c598103b12.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
6002
x-amz-cf-pop
FRA53-C1
server
AmazonS3
x-amz-server-side-encryption
AES256
google-play.svg
assets.orb.alkamitech.com/production/assets/themes/images/appLogos/ 		17 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.orb.alkamitech.com/production/assets/themes/images/appLogos/google-play.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-95.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7a8e38f6f996be8fb2cb80fadfb6655633acb8599e7f24fecf3138008350cd35

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://stcironline.com/

Response headers

content-encoding
gzip
x-amz-version-id
qy.Wg9POcx2VK0w7EY35E9bgk8uQNaif
etag
"2765eb451c9cd64d60234a6db113b772"
expires
Mon, 03 Nov 2042 21:03:57 GMT
x-cache
RefreshHit from cloudfront
x-amz-cf-id
s2eju16pF1yckoRwtWPqCqQ4erl-0xEZbXuTKgzoh2I9LSjqfY9zzA==
date
Fri, 11 Oct 2024 22:35:48 GMT
content-type
image/svg+xml
vary
Accept-Encoding
last-modified
Tue, 08 Nov 2022 21:04:00 GMT
x-amz-replication-status
COMPLETED
cache-control
max-age=630720000, no-cache, no-transform, public
via
1.1 86ef89199388021c33b079c598103b12.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
6416
x-amz-cf-pop
FRA53-C1
server
AmazonS3
x-amz-server-side-encryption
AES256
favicon.ico
stcironline.com/ 		564 B
446 B 		Other
General
Check archive.org
Download Go to
Full URL
https://stcironline.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.183.155 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://stcironline.com/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
speculation-rules
"/cdn-cgi/speculation"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l8fIPBn3ALF1oaTBt9K6yh6a7CVa%2FkeGT2jYD3N7OR%2FBVNqYOu%2FSLasjae%2FULNynFQOGZ0VHUw%2BjPpK%2B4apGGbh5iIwt9YAnl9dc2PKU2desUVUjz3RJpNCp55mvqsEQa%2FU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d12533edb95baaf-MXP
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 22:35:46 GMT
content-type
text/html
vary
Accept-Encoding
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spokane Teachers Credit Union (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://stcironline.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()