ctbcbanktw.top Open in urlscan Pro
172.67.138.144 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ctbcbanktw.top/
Effective URL:
https://ctbcbanktw.top/
Submission: On October 26 via api (October 26th 2024, 3:16:02 am UTC) from NL — Scanned from NL

Summary HTTP 5 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 172.67.138.144, located in United States and belongs to CLOUDFLARENET, US. The main domain is ctbcbanktw.top.
TLS certificate: Issued by WE1 on October 25th 2024. Valid for: 3 months.

This is the only time ctbcbanktw.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CTBC Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
5	172.67.138.144 172.67.138.144		13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2

5 172.67.138.144 (United States)

ASN13335 (CLOUDFLARENET, US)

ctbcbanktw.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ctbcbanktw.top ctbcbanktw.top	2 MB
5	1

	Domain	Requested by
5	ctbcbanktw.top	ctbcbanktw.top
5	1

This site contains links to these domains. Also see Links.

Domain
www.ctbcbank.com
www.ctbcprivatebank.com

Subject Issuer	Validity	Valid
ctbcbanktw.top WE1	`2024-10-25` - `2025-01-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ctbcbanktw.top/
Frame ID: 18AB5AA4AE39554CA21D932FAC31DFBD
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

中國信託商業銀行

Page URL History Show full URLs

http://ctbcbanktw.top/ HTTP 307
https://ctbcbanktw.top/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1721 kB
Transfer

4935 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ctbcbank.com/twrbc/twrbc-general/ot001/010
Title: 網路銀行

Search URL Search Domain Scan URL

URL: https://www.ctbcbank.com/content/twrbo/zh_tw/index
Title: 個人金融

Search URL Search Domain Scan URL

URL: https://www.ctbcbank.com/content/twrbo/zh_tw/sb_index
Title: 小型企業

Search URL Search Domain Scan URL

URL: https://www.ctbcbank.com/content/twcbo/zh_tw/index.html
Title: 法人金融

Search URL Search Domain Scan URL

URL: https://www.ctbcprivatebank.com/index.aspx
Title: 境外私人銀行

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ctbcbanktw.top/ HTTP 307
https://ctbcbanktw.top/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response ctbcbanktw.top/ Redirect Chain http://ctbcbanktw.top/ https://ctbcbanktw.top/	446 B 916 B	516ms 454ms	Document text/html	172.67.138.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ctbcbanktw.top/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3975d0d483e10580ea274e6f8320b49a840c08f9f17c486d74f5d030dc7bbc63` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8d8748dceaea2a62-CDG content-encoding br content-type text/html date Sat, 26 Oct 2024 03:15:55 GMT last-modified Sat, 26 Oct 2024 02:01:28 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKI20yvoVaND06HXiNQVCQoSrJ2iB%2BDsHjJxtfxIV6nYLtsNsrOAEigurabz7SdHa5agCnObQDRLKh1pIIjuHS%2BoE5hp6%2BszcLtQK1q6EdjX8%2BoR69HOzyQKdgvd3wTjEA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=48093&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4144&recv_bytes=4485&delivery_rate=411&cwnd=12000&unsent_bytes=0&cid=32cda690a94c5c41&ts=462&x=1" cfExtPri cfHdrFlush;dur=0 Redirect headers Location https://ctbcbanktw.top/ Non-Authoritative-Reason HttpsUpgrades
GET H3	200	index-BwnNfrKl.js Show response ctbcbanktw.top/assets/	2 MB 766 KB	692ms 691ms	Script application/javascript	172.67.138.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ctbcbanktw.top/assets/index-BwnNfrKl.js Requested by Host: ctbcbanktw.top URL: https://ctbcbanktw.top/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d27eacdb0189e19f1cd71b539c82907a50894cb756e18a86f3ebf4374618e90b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://ctbcbanktw.top Referer https://ctbcbanktw.top/ Response headers content-encoding gzip cf-cache-status MISS etag W/"671c4d7b-251096" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zh5npbP1ZOOoc66vta%2F4fLsAvxNejvBk6iVkfbk9op2gb2z%2FrhuEaHGAQj3C%2BXdQcUGhMp3EVKEoT6tFccuqOdOiVf5Pjt1D6IFl%2BdwAnUSPFQNM9J9BXJKWiazV8NOx2Q%3D%3D"}],"group":"cf-nel","max_age":604800} expires Sat, 26 Oct 2024 15:15:43 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=47470&sent=14&recv=13&lost=0&retrans=0&sent_bytes=5130&recv_bytes=5173&delivery_rate=22338&cwnd=12000&unsent_bytes=0&cid=32cda690a94c5c41&ts=1179&x=1", cfExtPri, cfHdrFlush;dur=0 date Sat, 26 Oct 2024 03:15:56 GMT content-type application/javascript last-modified Sat, 26 Oct 2024 02:01:31 GMT vary Accept-Encoding priority u=1,i=?0 cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8d8748dfec092a62-CDG server cloudflare
GET H3	200	index-iWLZaQ3n.css ctbcbanktw.top/assets/	2 MB 933 KB	735ms 735ms	Stylesheet text/css	172.67.138.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ctbcbanktw.top/assets/index-iWLZaQ3n.css Requested by Host: ctbcbanktw.top URL: https://ctbcbanktw.top/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f1459d149922adabf47ed8b8ead81ddf609d5592788f52a6bac7b33757560e70` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://ctbcbanktw.top Referer https://ctbcbanktw.top/ Response headers content-encoding gzip cf-cache-status MISS etag W/"671c4d7f-2780d7" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QHQhHMU4OW8iJhDNjs2hlPuAKatdHsgMemm1B%2BIhL1WNi7kHr3sFMhxeeNHX4JUB%2FOetc1H7N4eWRM60zakN21W3UhQKHZyR5BD9mRn2vwAHBMqumgoGOnmChS4FGemAeA%3D%3D"}],"group":"cf-nel","max_age":604800} expires Sat, 26 Oct 2024 15:15:43 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=47470&sent=24&recv=13&lost=0&retrans=0&sent_bytes=17130&recv_bytes=5173&delivery_rate=22338&cwnd=12000&unsent_bytes=0&cid=32cda690a94c5c41&ts=1209&x=1", cfExtPri, cfHdrFlush;dur=13 date Sat, 26 Oct 2024 03:15:56 GMT content-type text/css last-modified Sat, 26 Oct 2024 02:01:35 GMT vary Accept-Encoding priority u=0,i=?0 cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8d8748dfec0a2a62-CDG server cloudflare
GET DATA	200 OK	truncated /	562 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4b38a55b2a2f8eb161c35463e5fd7a6c13164fbaf14adad1c6fb69710de9582e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H3	200	loading_owl-BqDTsvzB.gif ctbcbanktw.top/assets/	22 KB 17 KB	710ms 710ms	Image image/gif	172.67.138.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ctbcbanktw.top/assets/loading_owl-BqDTsvzB.gif Requested by Host: ctbcbanktw.top URL: https://ctbcbanktw.top/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f19e9a12014a336da53374ebaaa1063e6aba0ee94545b4b5bf9b0830e11ba7f1` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://ctbcbanktw.top/ Response headers content-encoding gzip cf-cache-status MISS etag W/"671c4d80-571f" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kKtIHEM1iSI96Bp9k8EFWF1K47JNNnZHAq8%2BnCVzSSto6ILvGUjFE7m4aY66ygcxg95IHVB29QqW%2BCNEjMUmsMiW8Rtl95TZmT79T7mY6ZXrU0XnBhM%2BH%2BjWGLYE4j4pEQ%3D%3D"}],"group":"cf-nel","max_age":604800} expires Mon, 25 Nov 2024 03:15:45 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=43157&sent=1529&recv=220&lost=0&retrans=0&sent_bytes=1784654&recv_bytes=14796&delivery_rate=5047174&cwnd=261300&unsent_bytes=0&cid=32cda690a94c5c41&ts=3818&x=1", cfExtPri, cfHdrFlush;dur=0 date Sat, 26 Oct 2024 03:15:58 GMT content-type image/gif last-modified Sat, 26 Oct 2024 02:01:36 GMT vary Accept-Encoding priority u=3,i cache-control max-age=2592000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8d8748f049e22a62-CDG server cloudflare
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a9682bad4773031ad569063207d66da932b12e956b42f468136f52c1ae54c03f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	411 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `43380e29ccc4bf7873770ebd664baa5b91fe98a86789be1d3fc712f22eb6020d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	245 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2276f70eaefac25473bb47fedf36d72211861ce951543e69487a80ace2397c35` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	300 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5e2eeaac99b4cf71d9dfeca3bb984e481533a6a6473910212cfa68dae9921612` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	246 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dae65218fb285b095b08cf0e0631ec639b606c4ea60f239e485598cc76f6d03f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	314 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fd89b362aa651096b75e927c0230c23691936067c218a202661085c1a95dace1` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H3	200	favicon.ico ctbcbanktw.top/	5 KB 4 KB	54ms 54ms	Other image/x-icon	172.67.138.144 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ctbcbanktw.top/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.138.144 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e68c6b0aefb93dcd79dea97f8ddb15802c0752f69e7303bea9fc0096f880836b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://ctbcbanktw.top/ Response headers content-encoding br cf-cache-status HIT etag W/"671c4d78-1536" age 1763 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2FTpr7ctzBiOTfiYfgNXLuPhML5CLUvOiJikRxGQzUln9KsDm%2FvYE2gPWU4sdEEzDIOjpPN6oUseWsYVNBh%2BrvNR1zmZKoh21kt%2FUpqL8tl4haMAmspuFAmkLBTloLNMDA%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=43127&sent=1545&recv=222&lost=0&retrans=0&sent_bytes=1802244&recv_bytes=15191&delivery_rate=24808&cwnd=261300&unsent_bytes=0&cid=32cda690a94c5c41&ts=3876&x=1", cfExtPri, cfHdrFlush;dur=0 date Sat, 26 Oct 2024 03:15:58 GMT content-type image/x-icon last-modified Sat, 26 Oct 2024 02:01:28 GMT vary Accept-Encoding priority u=1,i cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8d8748f4cb572a62-CDG server cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CTBC Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ctbcbanktw.top
172.67.138.144
2276f70eaefac25473bb47fedf36d72211861ce951543e69487a80ace2397c35
3975d0d483e10580ea274e6f8320b49a840c08f9f17c486d74f5d030dc7bbc63
43380e29ccc4bf7873770ebd664baa5b91fe98a86789be1d3fc712f22eb6020d
4b38a55b2a2f8eb161c35463e5fd7a6c13164fbaf14adad1c6fb69710de9582e
5e2eeaac99b4cf71d9dfeca3bb984e481533a6a6473910212cfa68dae9921612
a9682bad4773031ad569063207d66da932b12e956b42f468136f52c1ae54c03f
d27eacdb0189e19f1cd71b539c82907a50894cb756e18a86f3ebf4374618e90b
dae65218fb285b095b08cf0e0631ec639b606c4ea60f239e485598cc76f6d03f
e68c6b0aefb93dcd79dea97f8ddb15802c0752f69e7303bea9fc0096f880836b
f1459d149922adabf47ed8b8ead81ddf609d5592788f52a6bac7b33757560e70
f19e9a12014a336da53374ebaaa1063e6aba0ee94545b4b5bf9b0830e11ba7f1
fd89b362aa651096b75e927c0230c23691936067c218a202661085c1a95dace1

ctbcbanktw.top Open in urlscan Pro 172.67.138.144 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

1721 kBTransfer

4935 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

ctbcbanktw.top Open in urlscan Pro
172.67.138.144 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1721 kB
Transfer

4935 kB
Size

0
Cookies

5 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!