![](/screenshots/18f451ce-90ed-435d-9bdd-4c546a8b5abb.png)
qnbfinsbank.com
Open in
urlscan Pro
68.65.123.121
Malicious Activity!
Public Scan
Effective URL: https://qnbfinsbank.com/login
Submission: On November 26 via manual from TR
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 14th 2020. Valid for: a year.
This is the only time qnbfinsbank.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Finansbank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 5 | 68.65.123.121 68.65.123.121 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 89.187.169.15 89.187.169.15 | 60068 (CDN77) (CDN77) | |
2 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2606:4700::68... 2606:4700::6810:125e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:81b::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2a04:4e42:1b:... 2a04:4e42:1b::621 | 54113 (FASTLY) (FASTLY) | |
1 1 | 172.67.72.223 172.67.72.223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700:20:... 2606:4700:20::681a:98b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a00:1450:400... 2a00:1450:4001:818::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:818::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:816::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 12 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server276-2.web-hosting.com
qnbfinsbank.com |
ASN60068 (CDN77, GB)
PTR: unn-89-187-169-15.cdn77.com
cdn.materialdesignicons.com |
ASN15169 (GOOGLE, US)
translate.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
googleapis.com
fonts.googleapis.com translate.googleapis.com |
93 KB |
5 |
qnbfinsbank.com
1 redirects
qnbfinsbank.com |
447 KB |
4 |
gstatic.com
fonts.gstatic.com www.gstatic.com |
30 KB |
3 |
tidiochat.com
widget-v4.tidiochat.com |
235 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
38 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
39 KB |
1 |
tidio.co
1 redirects
code.tidio.co |
648 B |
1 |
jsdelivr.net
cdn.jsdelivr.net |
8 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
google.com
translate.google.com |
2 KB |
1 |
materialdesignicons.com
cdn.materialdesignicons.com |
37 KB |
24 | 11 |
Domain | Requested by | |
---|---|---|
5 | qnbfinsbank.com |
1 redirects
qnbfinsbank.com
|
4 | translate.googleapis.com |
translate.google.com
translate.googleapis.com srcdoc |
3 | www.gstatic.com |
qnbfinsbank.com
translate.googleapis.com |
3 | widget-v4.tidiochat.com |
qnbfinsbank.com
code.tidio.co |
2 | cdnjs.cloudflare.com |
qnbfinsbank.com
|
2 | stackpath.bootstrapcdn.com |
qnbfinsbank.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | code.tidio.co | 1 redirects |
1 | cdn.jsdelivr.net |
qnbfinsbank.com
|
1 | code.jquery.com |
qnbfinsbank.com
|
1 | translate.google.com |
qnbfinsbank.com
|
1 | cdn.materialdesignicons.com |
qnbfinsbank.com
|
1 | fonts.googleapis.com |
qnbfinsbank.com
|
24 | 13 |
This site contains links to these domains. Also see Links.
Domain |
---|
translate.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
qnbfinsbank.com Sectigo RSA Domain Validation Secure Server CA |
2020-11-14 - 2021-11-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
cdn.materialdesignicons.com Sectigo RSA Domain Validation Secure Server CA |
2019-06-03 - 2021-06-02 |
2 years | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
*.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-10-26 - 2021-04-17 |
6 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://qnbfinsbank.com/login
Frame ID: 65C46E316F8C1013FCB7AB12E07EFBE6
Requests: 21 HTTP requests in this frame
Frame:
https://translate.googleapis.com/translate_a/l?client=te&alpha=true&hl=en&cb=callback
Frame ID: 921128F980AE2D48AFE1E272C881C7AE
Requests: 1 HTTP requests in this frame
Frame:
https://widget-v4.tidiochat.com//1_44_2/static/js/widget.25f149d94e7f5d0c1136.js
Frame ID: 34E942677EE93800F46D855D22D6E94E
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/18f451ce-90ed-435d-9bdd-4c546a8b5abb.png)
Page URL History Show full URLs
-
http://qnbfinsbank.com/login
HTTP 301
https://qnbfinsbank.com/login Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Translate
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://qnbfinsbank.com/login
HTTP 301
https://qnbfinsbank.com/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- https://code.tidio.co/rijpy5c0ldfhh3xpcedz1rgvce3wqf7y.js HTTP 302
- https://widget-v4.tidiochat.com/1_44_2/static/js/render.25f149d94e7f5d0c1136.js
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
qnbfinsbank.com/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 487 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
materialdesignicons.min.css
cdn.materialdesignicons.com/4.8.95/css/ |
214 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ |
156 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
qnbfinsbank.com/assets/css/ |
2 KB 889 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ |
86 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
element.js
translate.google.com/translate_a/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
qnbfinsbank.com/_assets/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/ |
59 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
render.25f149d94e7f5d0c1136.js
widget-v4.tidiochat.com/1_44_2/static/js/ Redirect Chain
|
15 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translateelement.css
translate.googleapis.com/translate_static/css/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
translate.googleapis.com/translate_static/js/element/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.jpg
qnbfinsbank.com/assets/images/ |
436 KB 436 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qkBbXvYC6trAT7RVLtyU5rZP.woff2
fonts.gstatic.com/s/karla/v14/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
element_main.js
translate.googleapis.com/element/TE_20200506_00/e/js/element/ |
238 KB 86 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/1x/ |
825 B 913 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ |
910 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
l
translate.googleapis.com/translate_a/ Frame 9211 |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
widget.25f149d94e7f5d0c1136.js
widget-v4.tidiochat.com//1_44_2/static/js/ Frame 34E9 |
814 KB 222 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tururu.mp3
widget-v4.tidiochat.com// Frame 34E9 |
7 KB 7 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Finansbank (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| google function| Popper object| bootstrap function| googleTranslateElementInit object| closure_lm_455870 object| SENTRY_RELEASE object| tidioChatApi0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdn.materialdesignicons.com
cdnjs.cloudflare.com
code.jquery.com
code.tidio.co
fonts.googleapis.com
fonts.gstatic.com
qnbfinsbank.com
stackpath.bootstrapcdn.com
translate.google.com
translate.googleapis.com
widget-v4.tidiochat.com
www.gstatic.com
172.67.72.223
2001:4de0:ac19::1:b:2b
2001:4de0:ac19::1:b:3a
2606:4700:20::681a:98b
2606:4700::6810:125e
2a00:1450:4001:816::2003
2a00:1450:4001:818::2003
2a00:1450:4001:818::200a
2a00:1450:4001:81b::200e
2a00:1450:4001:820::200a
2a04:4e42:1b::621
68.65.123.121
89.187.169.15
00272c89d239f65d8788f899605fb4d136eca15b8f77eb56883e96773b7c583d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
11852d22127c1a034fda7ff59dcf99a4abd5c98c899e21ee36bad977296f7973
12c7687514ca85ba2157ed61914ac526bb9dd15cb5a2a2d9e4d88f919349284f
13b5eece5a7359f9c0de2b4b3c24eeed42fa547e5811238bc9434dcc975bb101
18b91aa55babf6a41b67ad376266712f9e07172f8ec8c6d06904f622f15527c9
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213
2c01fcf4c587cd936cbb0d4349b9fc88dd585023f7059ccc8264a4f10622cf7d
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
329308ecf3ce21ad80952807caacd1df6d5198ea1f90afbcb5ce56a19fb67feb
463d320f57b87d42cabd82c26af68728aa524f180aff12ceede763eecbbbd0ca
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
5fe03bfd95a2d4e640ed7d04dcb08ef991c327a5ab6f6fdb9eb06e1efc76af30
6149f95c1ebdde5391898e22a79821a810336f6bd74318291b4f49f23fbf0fa8
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
80cfc390f534ca8d75ac161e82639486b1ee24b30c402af8bcc89d113ff343eb
8cefe6a0c37333a0c611e2498f5b8a422ea8c1d4f0ddc8083ecd0ca28e8dd57f
ac5c23a1cfe151b1985502ed26485126fb06bb8e0e96c933ba42dad59cd5150b
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
d4264619500235dca70807deaea7befa589175ebe0b0b125d3c2d6a0e5302826
e124d2ee4937293c9e133300243be148ca87cfda5062830ec77cd26ea102bafd
efbe90e7b36166f95684a5b566f597212296a4cd1b54363daf775170e1dde556