okay-99-bank.firebaseapp.com
Open in
urlscan Pro
2620:0:890::100
Malicious Activity!
Public Scan
Submission: On July 13 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1D4 on June 21st 2022. Valid for: 3 months.
This is the only time okay-99-bank.firebaseapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: bank99 (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 3 | 2606:4700::68... 2606:4700::6810:7caf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
12 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
firebaseapp.com
okay-99-bank.firebaseapp.com |
522 KB |
3 |
unpkg.com
2 redirects
unpkg.com — Cisco Umbrella Rank: 1044 |
4 KB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 459 |
108 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 695 |
30 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 258 |
6 KB |
0 |
servehttp.com
Failed
devcloud.servehttp.com Failed |
|
12 | 6 |
Domain | Requested by | |
---|---|---|
5 | okay-99-bank.firebaseapp.com |
okay-99-bank.firebaseapp.com
|
3 | unpkg.com |
2 redirects
okay-99-bank.firebaseapp.com
|
3 | cdn.jsdelivr.net |
okay-99-bank.firebaseapp.com
|
1 | code.jquery.com |
okay-99-bank.firebaseapp.com
|
1 | cdnjs.cloudflare.com |
okay-99-bank.firebaseapp.com
|
0 | devcloud.servehttp.com Failed |
okay-99-bank.firebaseapp.com
|
12 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
firebaseapp.com GTS CA 1D4 |
2022-06-21 - 2022-09-19 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://okay-99-bank.firebaseapp.com/banking/login.html
Frame ID: 169DAAA0B53040990C98835E587AECA7
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
AktivierungDetected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Axios (JavaScript libraries) Expand
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://unpkg.com/http-vue-loader HTTP 302
- https://unpkg.com/http-vue-loader@1.4.2 HTTP 302
- https://unpkg.com/http-vue-loader@1.4.2/src/httpVueLoader.js
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.html
okay-99-bank.firebaseapp.com/banking/ |
19 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
okay-99-bank.firebaseapp.com/banking/login_files/ |
2 MB 136 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
KhadmoPush.js
devcloud.servehttp.com/static/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.24.0/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cdn.jsdelivr.net/npm/vue/dist/ |
430 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
httpVueLoader.js
unpkg.com/http-vue-loader@1.4.2/src/ Redirect Chain
|
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue-loading.min.js
cdn.jsdelivr.net/npm/vue-loading-overlay@3.4.2/dist/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue-loading.css
cdn.jsdelivr.net/npm/vue-loading-overlay@3/dist/ |
539 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
login-background.jpg
okay-99-bank.firebaseapp.com/banking/login_files/ |
346 KB 337 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
okay-99-bank.firebaseapp.com/banking/login_files/ |
30 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PostSans-Regular.woff2
okay-99-bank.firebaseapp.com/banking/login_files/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- devcloud.servehttp.com
- URL
- https://devcloud.servehttp.com:2400/static/KhadmoPush.js?v=1.0.0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: bank99 (Banking)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| axios function| Vue function| httpVueLoader object| VueLoading function| $ function| jQuery object| app object| casVue0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
devcloud.servehttp.com
okay-99-bank.firebaseapp.com
unpkg.com
devcloud.servehttp.com
2001:4de0:ac18::1:a:2a
2606:4700::6810:5814
2606:4700::6810:7caf
2606:4700::6811:190e
2620:0:890::100
131d1ca390a6c78cfc5107889980dbd155184886cc0dd81400478d1330b805fe
553fc093f4b619f0f355bf89e4d885c25eb88df06997e5a58eb3d11947e0b385
66672591d919ebfc549339321b95a6c417d15a7a3049d64c9142555a9141e74b
68e795c679590da889387b2a35654e30db0a7621b1813f246cba75a7546fdac7
7e2e5b98761af2ad33e704867bd4ffca9206c60144e68b6d05ce8eab6298dfbd
80dd15364a4b9cc0b6c236826dea64a9bc6a39d0353557d132af20de9ea838bd
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
9a48abc1c0966ae27ea445a3af3f6602ffc5de898fcf007c1b32800cda33f787
a3b9b469d31790096180616fae0155d3af8088924ef1d724bfd085ff3d12f075
aed6ac78b8249a9c7cff0030f3b921ee9f771cb1684164f3e679e1023a4d5c69
b99795a6e9d15f6b14280967fce06845b9ba6391607d836d8b62b6327da0b0ac
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e