![](/screenshots/0079a6f3-a15a-47cc-8a62-06c0623ec8a0.png)
cornerrefundservice.com
Open in
urlscan Pro
68.65.123.130
Malicious Activity!
Public Scan
Effective URL: https://cornerrefundservice.com/refundsrvc/login.html?acs=_connect-run&secure=5540zef1415405412104ef151511d7f84f5ze1f510eec8bd0e
Submission: On June 21 via manual from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 21st 2021. Valid for: a year.
This is the only time cornerrefundservice.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cornèr Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 68.65.123.130 68.65.123.130 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
17 | 194.11.207.191 194.11.207.191 | 6830 (LIBERTYGL...) (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding) | |
19 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server276-5.web-hosting.com
cornerrefundservice.com |
ASN6830 (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding, aka AORTA), NL)
www.icorner.ch |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
icorner.ch
www.icorner.ch |
2 MB |
2 |
cornerrefundservice.com
cornerrefundservice.com |
2 KB |
19 | 2 |
Domain | Requested by | |
---|---|---|
17 | www.icorner.ch |
cornerrefundservice.com
|
2 | cornerrefundservice.com | |
19 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ebas.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cornerrefundservice.com Sectigo RSA Domain Validation Secure Server CA |
2021-06-21 - 2022-06-21 |
a year | crt.sh |
www.icorner.ch DigiCert ECC Extended Validation Server CA |
2020-07-24 - 2022-07-29 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://cornerrefundservice.com/refundsrvc/login.html?acs=_connect-run&secure=5540zef1415405412104ef151511d7f84f5ze1f510eec8bd0e
Frame ID: A29048C435F3819677EE8B018D4460F4
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/0079a6f3-a15a-47cc-8a62-06c0623ec8a0.png)
Page Title
Login: iCornèr | Cornèrcard | OnlineaccessPage URL History Show full URLs
- https://cornerrefundservice.com/refundsrvc/ Page URL
- https://cornerrefundservice.com/refundsrvc/login.html?acs=_connect-run&secure=5540zef1415405412104ef151511d7... Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Detected patterns
- headers server /^LiteSpeed$/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://cornerrefundservice.com/refundsrvc/ Page URL
- https://cornerrefundservice.com/refundsrvc/login.html?acs=_connect-run&secure=5540zef1415405412104ef151511d7f84f5ze1f510eec8bd0e Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
cornerrefundservice.com/refundsrvc/ |
226 B 341 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.html
cornerrefundservice.com/refundsrvc/ |
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.0 |
bootstrap.min.css
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
254 KB 254 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.0 |
sticky-footer-navbar.css
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
254 KB 254 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.0 |
default.css
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
254 KB 254 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.0 |
icons.css
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
254 KB 254 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.0 |
ie7.css
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
254 KB 254 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.min.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
85 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.inputmasked.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
10 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.cookie.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
momentjs.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
146 KB 146 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
54 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
validation.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
11 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common-translation.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
963 B 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
342 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
11 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_ebas_weiss_de.png
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.0 |
overlay.css
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
254 KB 254 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overlay.js
www.icorner.ch/nevislogrend/nevislogrend/applications/www-icorner-ch--realm/webdata/resources/ |
4 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
190 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cornèr Bank (Banking)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| globalparameters function| $ function| jQuery function| moment object| bootstrap boolean| validDate boolean| futureDate object| dateNow number| currentYear function| messagePan function| messageCreditnumberValid function| messageCreditnumberInvalid function| messageBirthday function| messageBirthdayMustBe function| messageMonthInvalid function| messageDayInvalid function| messageDateInvalid function| messageDateNotInTheFuture function| messagePasswordMatch function| messagePasswordNotMatch function| messagePasswordIsStrong function| messagePasswordIsNotStrong function| messageBankFooter function| clean function| transl8 object| translation_data function| overlayTitle function| overlayMessage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cornerrefundservice.com
www.icorner.ch
194.11.207.191
68.65.123.130
15c387db3a79471b99574c203f5d38620723a2c611b2c0e31c05336efd96d04d
19c798ed72c9f4c04a924577de91e7f65d7c821ee89527941d7800f8d1548f97
1c6283fafd793ca03e608582aa9f99439996ab01ac1a43f985201b8ddce4f721
29f96874bd53736f243f7d529a63ae9521ee5198b517d9ec41f74700f98c95fe
54b5a78395929483701c7a36796e427d24925551a22eec1dadef9cefba99a66f
5ab136ccd5b4160256a3f7958e319df9af8a519c1ad1f97c14051685a8faba63
86beb92550a450db2760b99dfcd37d3bc906b4ff1c1e293329db289fc372c076
8a14aa5d7e714a46585e47b03c1090f128c19afb42ccd1ff8676aea30f204d23
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
c2109aa73f3cc71b61b8b05d859b51dfb603584277bcc33451f38e9343959cef
e02aa7d64496e4e74f5cf9231e6a52246b4ba9685e3e9ab109c0c8fdd0cf9f28
eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267
ec2921213ea0f4e9ec155e072a06e43ed5abdbcb4846c14e627c17c078ce43e3
f25d9df70edcf18f2167d9a4a0325d80c56f6ffa6ef5372bf57083f1a9d5127f