![](/screenshots/17e10039-c4ff-4f35-b48f-d72d75b5b27f.png)
mysquares.com.au
Open in
urlscan Pro
166.62.10.227
Malicious Activity!
Public Scan
Effective URL: https://mysquares.com.au/support/UBS/UBS/log/apps/
Submission: On October 01 via automatic, source openphish
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on June 28th 2018. Valid for: 2 years.
This is the only time mysquares.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UBS (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 217.160.0.217 217.160.0.217 | 8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48) | |
1 | 166.62.10.227 166.62.10.227 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
3 7 | 193.5.104.212 193.5.104.212 | 8883 (Switzerland) (Switzerland) | |
3 3 | 193.5.104.211 193.5.104.211 | 8883 (Switzerland) (Switzerland) | |
8 | 4 |
ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
PTR: 217-160-0-217.elastic-ssl.ui-r.com
www.ecas-heartrhythm.org |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-10-227.ip.secureserver.net
mysquares.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
ubs.com
ebanking-ch1.ubs.com Failed ebanking-ch.ubs.com secure.ubs.com Failed |
168 KB |
1 |
mysquares.com.au
mysquares.com.au |
4 KB |
1 |
ecas-heartrhythm.org
www.ecas-heartrhythm.org |
407 B |
8 | 3 |
Domain | Requested by | |
---|---|---|
7 | ebanking-ch1.ubs.com |
mysquares.com.au
ebanking-ch1.ubs.com |
3 | ebanking-ch.ubs.com | 3 redirects |
1 | mysquares.com.au | |
1 | www.ecas-heartrhythm.org | |
0 | secure.ubs.com Failed |
mysquares.com.au
|
8 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ubs.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
mysquares.com.au COMODO RSA Domain Validation Secure Server CA |
2018-06-28 - 2020-06-27 |
2 years | crt.sh |
ebanking-ch.ubs.com DigiCert Global CA G2 |
2018-07-05 - 2019-03-15 |
8 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mysquares.com.au/support/UBS/UBS/log/apps/
Frame ID: 1A017EE24ECC0AC74F0EA6C6071F35F2
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/17e10039-c4ff-4f35-b48f-d72d75b5b27f.png)
Page URL History Show full URLs
- http://www.ecas-heartrhythm.org/e-login/ Page URL
- https://mysquares.com.au/support/UBS/UBS/log/apps/ Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Help
Search URL Search Domain Scan URL
Title: Information on UBS
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Report fraudulent mail
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.ecas-heartrhythm.org/e-login/ Page URL
- https://mysquares.com.au/support/UBS/UBS/log/apps/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/ubswidgets/css/UbsWidgets_NewBrand3.css HTTP 302
- https://ebanking-ch.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/ubswidgets/css/UbsWidgets_NewBrand3.css HTTP 302
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/ubswidgets/css/UbsWidgets_NewBrand3.css?NavLB_EBCH=1538398802 HTTP 302
- https://ebanking-ch1.ubs.com/ErrorRedirector
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/css/default.css HTTP 302
- https://ebanking-ch.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/css/default.css HTTP 302
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/css/default.css?NavLB_EBCH=1538398802
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/jquery.js HTTP 302
- https://ebanking-ch.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/jquery.js HTTP 302
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/jquery.js?NavLB_EBCH=1538398802
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/default.js HTTP 302
- https://ebanking-ch.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/default.js HTTP 302
- https://ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/default.js
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
www.ecas-heartrhythm.org/e-login/ |
201 B 407 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
![]() mysquares.com.au/support/UBS/UBS/log/apps/ |
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ErrorRedirector
ebanking-ch1.ubs.com/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.css
ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/css/ Redirect Chain
|
38 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/ Redirect Chain
|
90 KB 91 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.js
ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/script/ Redirect Chain
|
15 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
servicefailure
secure.ubs.com/__ebanking-ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
illustrations-login_keychain.png
ebanking-ch1.ubs.com/login/resources/nevislogrend/applications/ebanklr/webdata/images/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
526 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ebanking-ch1.ubs.com
- URL
- https://ebanking-ch1.ubs.com/ErrorRedirector
- Domain
- secure.ubs.com
- URL
- http://secure.ubs.com/__ebanking-ch/servicefailure
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UBS (Banking)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| focusNextWhenFullOrEmpty function| setFocus function| getCaret function| selectCurrentElem function| upperCaseContent function| hasCssClass function| removeCssClass function| addCssClass function| updatePasswordStrengthIndicator function| validateFieldSameAs function| validateFieldMarkAsInvalid function| numpadShow function| numpadHide function| numpadClick string| lowerCaseRegEx string| upperCaseRegEx string| numberRegEx string| specialCharRegEx string| whiteSpaceRegEx object| pwRegex object| whiteSpaceRegExFunction function| cgvCheckPwQuality function| isConsecutiveNumbers function| isNumber function| getMaskEl function| showModalMask function| isMaskShown function| lrGetElementsByClassName function| dialogRules function| disableFormElements function| showConfirmationBox function| baseSubmitHandler function| extSubmitHandler function| getContractNumberAndFetch function| ubsDropdownMenu function| showHelpWnd function| mobileCRFrame function| setValues function| poscursor function| fitModalMaskToScreen0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ebanking-ch.ubs.com
ebanking-ch1.ubs.com
mysquares.com.au
secure.ubs.com
www.ecas-heartrhythm.org
ebanking-ch1.ubs.com
secure.ubs.com
166.62.10.227
193.5.104.211
193.5.104.212
217.160.0.217
167d91249d9000e337cbaaaa58a6f446f0beba3fa2b62eaef0fddd2a82f82263
2192281c5f07f6a11781f3f980f4cc3542ca6cbf29c417c0eb5d1636c84863a4
2dae2d895fa831d6208385aead0e256f958baad842c5c36149ae7231615114c1
329a54a4d1966abb2a846911add2bbee0944c6afd17cff49f3a86cb24a2e2c37
5c079eac52665a64c861389822bcdd63969f917ce5d1631336e247a334eeac95
6316f169cdaca66a077a4e1e2f5b1a7d611d1a91bef441e186cc38a239e9e9d6
aa084d3968ab19898ebbed807ebc134b622fab78a888e7b36ae8386841636801