aib-ie.info - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 176.123.0.83, located in Chisinau, Moldova and belongs to ALEXHOST, MD. The main domain is aib-ie.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 26th 2023. Valid for: 3 months.

This is the only time aib-ie.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Allied Irish Banks (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 4	176.123.0.83 176.123.0.83	200019 (ALEXHOST) (ALEXHOST)
1	194.69.199.12 194.69.199.12	16282 (AIB-AS-1) (AIB-AS-1)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	3

4 176.123.0.83 (Chisinau, Moldova) 1 redirects

ASN200019 (ALEXHOST, MD)
PTR: lshost3.alexhost.com

aib-ie.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.69.199.12 (Ireland)

ASN16282 (AIB-AS-1, IE)

auth.aib.ie	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	aib-ie.info 1 redirects aib-ie.info	76 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 198	4 KB
1	aib.ie auth.aib.ie — Cisco Umbrella Rank: 487163	170 KB
5	3

	Domain	Requested by
4	aib-ie.info	1 redirects aib-ie.info
1	cdnjs.cloudflare.com	aib-ie.info
1	auth.aib.ie	aib-ie.info
5	3

This site contains links to these domains. Also see Links.

Domain
aib.ie

Subject Issuer	Validity	Valid
aib-ie.info cPanel, Inc. Certification Authority	`2023-01-26` - `2023-04-26`	3 months	crt.sh
auth.aib.ie DigiCert EV RSA CA G2	`2022-05-09` - `2023-05-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://aib-ie.info/
Frame ID: 28EBEA863372BCCA435583B7BC213507
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in

Page URL History Show full URLs

http://aib-ie.info/ HTTP 301
https://aib-ie.info/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

249 kB
Transfer

350 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://aib.ie/secure-internet-shopping/aib-authentication
Title: Terms

Search URL Search Domain Scan URL

URL: https://aib.ie/secure-internet-shopping/digital-id/help-faqs
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://aib-ie.info/ HTTP 301
https://aib-ie.info/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
aib-ie.info/
Redirect Chain

http://aib-ie.info/
https://aib-ie.info/

24 KB
7 KB

327ms
161ms

Document
text/html

176.123.0.83
ALEXHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://aib-ie.info/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.123.0.83 Chisinau, Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS: lshost3.alexhost.com
Software: LiteSpeed /
Resource Hash: 02c1d9a5daf4c1462f6006ed8d1751b7b45be6fdffa4c188c6a9670ae4d76529

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 27 Jan 2023 11:08:08 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 707
content-type: text/html
date: Fri, 27 Jan 2023 11:08:07 GMT
location: https://aib-ie.info/
server: LiteSpeed

GET
H2 200 jquery.js Show response
aib-ie.info/js/ 87 KB
30 KB 82ms
81ms Script
application/javascript 176.123.0.83
ALEXHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://aib-ie.info/js/jquery.js
Requested by: Host: aib-ie.info
URL: https://aib-ie.info/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.123.0.83 Chisinau, Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS: lshost3.alexhost.com
Software: LiteSpeed /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://aib-ie.info/
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36

Response headers

date: Fri, 27 Jan 2023 11:08:08 GMT
content-encoding: br
last-modified: Wed, 21 Apr 2021 20:00:21 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 30267
expires: Fri, 03 Feb 2023 11:08:08 GMT

GET
H/1.1 200
OK main.css
auth.aib.ie/assets/css/ 169 KB
170 KB 253ms
69ms Stylesheet
text/css 194.69.199.12
AIB-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.aib.ie/assets/css/main.css

Requested by

Host: aib-ie.info
URL: https://aib-ie.info/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

194.69.199.12 , Ireland, ASN16282 (AIB-AS-1, IE),

Reverse DNS

Software

/

Resource Hash

98e5c5e21c76cd216b97778ee3711da0e39fdb8b6ef095bf9489fe4e98114894

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://.aib.ie; img-src 'self' p.typekit.net https://.aib.ie; base-uri 'self' https://.aib.ie; object-src 'self'; frame-ancestors 'self' https://.aib.ie https://onlinebanking.ebs.ie
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://aib-ie.info/
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36

Response headers

Date: Fri, 27 Jan 2023 11:08:08 GMT
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie; img-src 'self' p.typekit.net https://*.aib.ie; base-uri 'self' https://*.aib.ie; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie
Referrer-Policy: origin
Strict-Transport-Security: max-age=15552000; includeSubDomains
Last-Modified: Sat, 26 Oct 1985 08:15:00 GMT
Content-Type: text/css
Cache-Control: max-age=0, must-revalidate
Content-Length: 173248

GET
H2 200 jquery.mask.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ 8 KB
4 KB 114ms
41ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js

Requested by

Host: aib-ie.info
URL: https://aib-ie.info/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://aib-ie.info/
Origin: https://aib-ie.info
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36

Response headers

date: Fri, 27 Jan 2023 11:08:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3157863
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3074
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-2087"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5amkxpzZHSd3Qjq8YJTFPm7LVcObz2qPZr5B1%2FSXsSs4gpMyCbLNGGPT9pvkr%2F%2FQ18gd2hdMXIYtJGQ%2F7g7w491wn27fcgz1V1DbGbCqD4PFHbWDuSNSyHLa7pfh%2BasISJ7oaTzZiGoxK%2FgYcS70Thmw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 790107580e70dcf7-LHR
expires: Wed, 17 Jan 2024 11:08:08 GMT

GET
H3 200 ProximaNova-Regular.otf
aib-ie.info/fonts/ 61 KB
39 KB 83ms
83ms Font
font/otf 176.123.0.83
ALEXHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://aib-ie.info/fonts/ProximaNova-Regular.otf
Requested by: Host: aib-ie.info
URL: https://aib-ie.info/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.123.0.83 Chisinau, Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS: lshost3.alexhost.com
Software: LiteSpeed /
Resource Hash: 2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9

Request headers

Referer: https://aib-ie.info/
Origin: https://aib-ie.info
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36

Response headers

date: Fri, 27 Jan 2023 11:08:08 GMT
content-encoding: br
last-modified: Wed, 21 Apr 2021 19:05:28 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: font/otf
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 39375

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Allied Irish Banks (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			aib-ie.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: a504c6ddd76453063dc72bfc501d2796

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aib-ie.info
auth.aib.ie
cdnjs.cloudflare.com
176.123.0.83
194.69.199.12
2606:4700::6811:180e
02c1d9a5daf4c1462f6006ed8d1751b7b45be6fdffa4c188c6a9670ae4d76529
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
98e5c5e21c76cd216b97778ee3711da0e39fdb8b6ef095bf9489fe4e98114894
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

aib-ie.info Open in urlscan Pro 176.123.0.83 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

249 kBTransfer

350 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

1 Cookies

Indicators

aib-ie.info Open in urlscan Pro
176.123.0.83 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

249 kB
Transfer

350 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!