data-6c4cf.web.app
Open in
urlscan Pro
151.101.65.195
Malicious Activity!
Public Scan
Effective URL: https://data-6c4cf.web.app/
Submission: On May 15 via automatic, source openphish
Summary
TLS certificate: Issued by GTS CA 1D4 on March 17th 2021. Valid for: 3 months.
This is the only time data-6c4cf.web.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Scotiabank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 151.101.65.195 151.101.65.195 | 54113 (FASTLY) (FASTLY) | |
1 | 104.109.89.101 104.109.89.101 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
14 | 3 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-109-89-101.deploy.static.akamaitechnologies.com
auth.scotiaonline.scotiabank.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
web.app
data-6c4cf.web.app |
107 KB |
1 |
scotiabank.com
auth.scotiaonline.scotiabank.com |
440 B |
14 | 2 |
Domain | Requested by | |
---|---|---|
4 | data-6c4cf.web.app |
data-6c4cf.web.app
|
1 | auth.scotiaonline.scotiabank.com |
data-6c4cf.web.app
|
14 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.scotiabank.com |
assets.kampyle.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1D4 |
2021-03-17 - 2021-06-15 |
3 months | crt.sh |
auth.scotiabank.com Entrust Certification Authority - L1K |
2020-02-27 - 2022-02-27 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://data-6c4cf.web.app/
Frame ID: 49DD271AC112D4D9A2693C40F03C075A
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://data-6c4cf.web.app/
HTTP 307
https://data-6c4cf.web.app/ Page URL
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: Scotiabank
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Feedback
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://data-6c4cf.web.app/
HTTP 307
https://data-6c4cf.web.app/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
data-6c4cf.web.app/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.7ad7b082.chunk.css
data-6c4cf.web.app/static/css/ |
40 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.4c09cc66.chunk.js
data-6c4cf.web.app/static/js/ |
324 KB 90 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.b5dbb6ad.chunk.js
data-6c4cf.web.app/static/js/ |
68 KB 9 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
79cc1505bcf15f59a89c759511622c04.svg
auth.scotiaonline.scotiabank.com/assets/ |
231 B 440 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
15243e297f5364bd59f4088a864abbf7.woff
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fd1c0f449fc8540f82c47e1629cbd5dd.woff2
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
8fd30bd010d9e2c7677ec339685f958b.woff
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
00cecde981e3ef7491eba946f4b95fe0.woff
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
64a8523319c68ca5e492309a68af4a9e.woff2
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
a214561fc17b4b34b7a363dea6547e20.woff
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
50805f331bb1b697aafb6f0c28b09212.woff2
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
3ca6c3facf3966b88b55118f7821ee72.woff2
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
b80f217d987e2499bbeda3a508530b4f.ttf
auth.scotiaonline.scotiabank.com/assets/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/15243e297f5364bd59f4088a864abbf7.woff
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/fd1c0f449fc8540f82c47e1629cbd5dd.woff2
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/8fd30bd010d9e2c7677ec339685f958b.woff
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/00cecde981e3ef7491eba946f4b95fe0.woff
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/64a8523319c68ca5e492309a68af4a9e.woff2
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/a214561fc17b4b34b7a363dea6547e20.woff
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/50805f331bb1b697aafb6f0c28b09212.woff2
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/3ca6c3facf3966b88b55118f7821ee72.woff2
- Domain
- auth.scotiaonline.scotiabank.com
- URL
- https://auth.scotiaonline.scotiabank.com/assets/b80f217d987e2499bbeda3a508530b4f.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Scotiabank (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| webpackJsonptaz object| regeneratorRuntime0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.scotiaonline.scotiabank.com
data-6c4cf.web.app
auth.scotiaonline.scotiabank.com
104.109.89.101
151.101.65.195
2e775d1c6abbd0d4e1f77b8281d867790566fcd6897b28389e3f85b4d39f5084
88c6b782a615e306c31353f6e25e27eafa3e7e84c4a0805a31979b09f053ece5
9d2fc8c892dc10f597690d1614ffcc06480135ab78c34303eeee8cfdc9159996
d337169800f0de7a90e2b1df880b1240a1d67b4e51cb1f6d954cc79984828fef
fe9f641c02e48c97194c527ab8e1ad76902f34d771010f4178ac1f8521405c04