steveconleysales.com Open in urlscan Pro
13.68.139.112 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
Submission: On May 02 via manual (May 2nd 2023, 9:05:29 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 13.68.139.112, located in Tappahannock, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is steveconleysales.com.

This is the only time steveconleysales.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Scotiabank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	13.68.139.112 13.68.139.112	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
9	3

3 13.68.139.112 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

steveconleysales.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	steveconleysales.com steveconleysales.com	807 KB
2	googletagmanager.com 1 redirects www.googletagmanager.com — Cisco Umbrella Rank: 114	39 KB
0	dewicd.com Failed dewicd.com Failed
0	scotiabank.com Failed mobilebanking4.scotiabank.com Failed
9	4

	Domain	Requested by
3	steveconleysales.com	steveconleysales.com
2	www.googletagmanager.com	1 redirects steveconleysales.com
0	dewicd.com Failed	steveconleysales.com
0	mobilebanking4.scotiabank.com Failed	steveconleysales.com
9	4

This site contains links to these domains. Also see Links.

Domain
mobilebanking1.scotiabank.com
www.scotiabank.com
www1.scotiaonline.scotiabank.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
Frame ID: D4AFDB2BB7631C32EDBADE75E06E003E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Scotiabank-BankingWeb

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js

Page Statistics

9
Requests

0 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

846 kB
Transfer

906 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://mobilebanking1.scotiabank.com/
Title: Classic Scotiabank Mobile Website

Search URL Search Domain Scan URL

URL: http://www.scotiabank.com/ca/en/0,,317,00.html
Title: iOS/Android apps

Search URL Search Domain Scan URL

URL: https://www1.scotiaonline.scotiabank.com/online/authentication/authentication.bns
Title: Scotia OnLine

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://steveconleysales.com/interac/directing/scotiabank/online/authentication/files/bd-1-29 HTTP 302
https://dewicd.com/?s=steveconleysales.com

Request Chain 5

http://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8 HTTP 302
https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8

Request Chain 6

http://steveconleysales.com/interac/directing/scotiabank/online/authentication/locales/en-US/translation.json?_=1683061500117 HTTP 302
https://dewicd.com/?s=steveconleysales.com

Request Chain 7

http://steveconleysales.com/interac/directing/scotiabank/online/authentication/locales/en/translation.json?_=1683061500118 HTTP 302
https://dewicd.com/?s=steveconleysales.com

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Scotiabank-BankingWeb.html Show response
steveconleysales.com/interac/directing/scotiabank/online/authentication/ 16 KB
16 KB 487ms
99ms Document
text/html 13.68.139.112
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 13.68.139.112 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache/2.4.54 (cPanel) OpenSSL/1.1.1q mod_bwlimited/1.4 /
Resource Hash: 0c73ce40c7b375303c1d6a103b47b452120346a51b4597aea49ecd0e0bd42645

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 16144
Content-Type: text/html
Date: Tue, 02 May 2023 21:04:58 GMT
ETag: "3f10-56db0be6c6600"
Keep-Alive: timeout=5, max=100
Last-Modified: Sat, 02 Jun 2018 23:06:00 GMT
Server: Apache/2.4.54 (cPanel) OpenSSL/1.1.1q mod_bwlimited/1.4

GET css.css
mobilebanking4.scotiabank.com/bankingweb/css/ 0
0

GET
H/1.1 200
OK scripts.js Show response
steveconleysales.com/interac/directing/scotiabank/online/authentication/files/ 778 KB
779 KB 186ms
100ms Script
application/javascript 13.68.139.112
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/files/scripts.js
Requested by: Host: steveconleysales.com
URL: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 13.68.139.112 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache/2.4.54 (cPanel) OpenSSL/1.1.1q mod_bwlimited/1.4 /
Resource Hash: af2f544a6c0fe78d7cdafd87b1bf2d65865c6823070fb88f029a8eb7851d1621

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 02 May 2023 21:04:59 GMT
Last-Modified: Mon, 16 Apr 2018 02:31:36 GMT
Server: Apache/2.4.54 (cPanel) OpenSSL/1.1.1q mod_bwlimited/1.4
ETag: "c2913-569ee0552d200"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 796947

GET
H/1.1 200
OK logo.svg
steveconleysales.com/interac/directing/scotiabank/online/authentication/files/ 12 KB
13 KB 105ms
104ms Image
image/svg+xml 13.68.139.112
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/files/logo.svg
Requested by: Host: steveconleysales.com
URL: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 13.68.139.112 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache/2.4.54 (cPanel) OpenSSL/1.1.1q mod_bwlimited/1.4 /
Resource Hash: 64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 02 May 2023 21:05:00 GMT
Last-Modified: Mon, 16 Apr 2018 02:31:36 GMT
Server: Apache/2.4.54 (cPanel) OpenSSL/1.1.1q mod_bwlimited/1.4
ETag: "30d0-569ee0552d200"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 12496

GET login-logo.svg
mobilebanking4.scotiabank.com/bankingweb/images/en/ 0
0

GET

/
dewicd.com/
Redirect Chain

http://steveconleysales.com/interac/directing/scotiabank/online/authentication/files/bd-1-29
https://dewicd.com/?s=steveconleysales.com

0
0

GET
H2

200

gtm.js Show response
www.googletagmanager.com/
Redirect Chain

http://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8

99 KB
39 KB

47ms
21ms

Script
application/javascript

2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8

Requested by

Host: steveconleysales.com
URL: http://steveconleysales.com/interac/directing/scotiabank/online/authentication/Scotiabank-BankingWeb.html

Protocol

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae55623093aa421f26c8bf29e0486ecc3d9f2b1a88adad9f982dad057147465c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://steveconleysales.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 21:05:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 39762
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 02 May 2023 21:05:00 GMT

Redirect headers

Location: https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
Date: Tue, 02 May 2023 21:05:00 GMT
Cross-Origin-Resource-Policy: cross-origin
Server: Google Tag Manager
Content-Length: 250
X-XSS-Protection: 0
Content-Type: text/html; charset=UTF-8

GET

/
dewicd.com/
Redirect Chain

http://steveconleysales.com/interac/directing/scotiabank/online/authentication/locales/en-US/translation.json?_=1683061500117
https://dewicd.com/?s=steveconleysales.com

0
0

GET

/
dewicd.com/
Redirect Chain

http://steveconleysales.com/interac/directing/scotiabank/online/authentication/locales/en/translation.json?_=1683061500118
https://dewicd.com/?s=steveconleysales.com

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mobilebanking4.scotiabank.com
URL: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css

Domain: mobilebanking4.scotiabank.com
URL: https://mobilebanking4.scotiabank.com/bankingweb/images/en/login-logo.svg

Domain: dewicd.com
URL: https://dewicd.com/?s=steveconleysales.com

Domain: dewicd.com
URL: https://dewicd.com/?s=steveconleysales.com

Domain: dewicd.com
URL: https://dewicd.com/?s=steveconleysales.com

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			steveconleysales.com/	1970-01-20 11:41:06	Name: __geo2ads Value: id%3Dsteveconleysales.com

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://mobilebanking4.scotiabank.com/bankingweb/images/en/login-logo.svg Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dewicd.com
mobilebanking4.scotiabank.com
steveconleysales.com
www.googletagmanager.com
dewicd.com
mobilebanking4.scotiabank.com
13.68.139.112
2a00:1450:4001:828::2008
0c73ce40c7b375303c1d6a103b47b452120346a51b4597aea49ecd0e0bd42645
64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1
ae55623093aa421f26c8bf29e0486ecc3d9f2b1a88adad9f982dad057147465c
af2f544a6c0fe78d7cdafd87b1bf2d65865c6823070fb88f029a8eb7851d1621

steveconleysales.com Open in urlscan Pro 13.68.139.112 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

846 kBTransfer

906 kBSize

1 Cookies

3 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

steveconleysales.com Open in urlscan Pro
13.68.139.112 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

846 kB
Transfer

906 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!