studiogamesar.icu
Open in
urlscan Pro
88.218.16.198
Malicious Activity!
Public Scan
URL:
https://studiogamesar.icu/ev.html
Submission: On November 13 via automatic, source openphish
Submission: On November 13 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 88.218.16.198, located in
Dronten, Netherlands and
belongs to SERVERIUS-AS, NL.
The main domain is studiogamesar.icu.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 11th 2020. Valid for: 3 months.
This is the only time studiogamesar.icu was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 11th 2020. Valid for: 3 months.
This is the only time studiogamesar.icu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commonwealth Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 88.218.16.198 88.218.16.198 | 50673 (SERVERIUS-AS) (SERVERIUS-AS) | |
| 4 | 24.244.156.42 24.244.156.42 | 15146 (CABLEBAHAMAS) (CABLEBAHAMAS) | |
| 11 | 2 |
4
24.244.156.42
(Nassau, Bahamas)
ASN15146 (CABLEBAHAMAS, BS)
PTR: cbleib.combankltd.com
ASN15146 (CABLEBAHAMAS, BS)
PTR: cbleib.combankltd.com
| cbleib.combankltd.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
studiogamesar.icu
studiogamesar.icu |
832 KB |
| 4 |
combankltd.com
cbleib.combankltd.com |
13 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | studiogamesar.icu |
studiogamesar.icu
|
| 4 | cbleib.combankltd.com |
studiogamesar.icu
|
| 11 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| play.google.com |
| itunes.apple.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| studiogamesar.icu cPanel, Inc. Certification Authority |
2020-11-11 - 2021-02-09 |
3 months | crt.sh |
| cbleib.combankltd.com DigiCert SHA2 Extended Validation Server CA |
2020-06-05 - 2022-06-29 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://studiogamesar.icu/ev.html
Frame ID: 69683A81271199D721241631481C6D90
Requests: 11 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
URL: https://play.google.com/store/apps/details?id=com.combankltd.direct
Title:
Title:
Search URL Search Domain Scan URL
URL: https://itunes.apple.com/us/app/id1438207631
Title:
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
ev.html
studiogamesar.icu/ |
18 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vendor.css
studiogamesar.icu/files/ |
209 KB 209 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
omnia.css
studiogamesar.icu/files/ |
550 KB 550 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
studiogamesar.icu/files/ |
55 KB 55 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
RxZJdnzeo3R5zSexge8UUT8E0i7KZn-EPnyo3HZu7kw.woff
studiogamesar.icu/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Hgo13k-tfSpn0qi1SFdUfT8E0i7KZn-EPnyo3HZu7kw.woff
studiogamesar.icu/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2UX7WLTfW3W8TclTUvlFyQ.woff
studiogamesar.icu/files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
available-in-googleplay.png
cbleib.combankltd.com/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
available-in-appstore.png
cbleib.combankltd.com/img/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
phone@2x.png
cbleib.combankltd.com/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
envelope@2x.png
cbleib.combankltd.com/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commonwealth Bank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cbleib.combankltd.com
studiogamesar.icu
24.244.156.42
88.218.16.198
3801fd9afb62498f75f381dbff951f3b4b9d3bfaeefaba68b93ca7ffce4b5ac9
4fb6515540e7585a6d7b1b70915981ad528bdccd4beef366d33785d61abaa7a2
6d2f45997b5a9cadc60c13beedbbf843d2b1718d47f813d915384e44f26a05ef
8fb45fc08db7c6cf27900a5ef08eed4c03ec2a8362ccea2d818793a1e01765f8
a3b060f50471b8d5141aa40f89b07c30986a985a47b403e511a9244753a1437e
af2e512f2c734d26e24589b243994f37791e43f8cc02c4f70b245c4b284c1fc0
c24ed5aca62c867c12e5bab77658a7ffe58c3811c91fe63dc0da6eaa81c9bc00
c2e6a80ec2cff8a14941fed24062c4e0c15bec16c38b0d1b736922cc70c1062c