![](/screenshots/2cfd08c6-dac6-4b7e-a1b5-67454265dac7.png)
login.mail-snel.be
Open in
urlscan Pro
52.47.86.225
Malicious Activity!
Public Scan
Submission: On May 25 via api from IE — Scanned from FR
Summary
TLS certificate: Issued by l0ginwkeybnkefily.me on May 6th 2024. Valid for: a year.
This is the only time login.mail-snel.be was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: KeyBank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 52.47.86.225 52.47.86.225 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 146.75.121.230 146.75.121.230 | 54113 (FASTLY) (FASTLY) | |
1 | 23.49.77.76 23.49.77.76 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
17 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-47-86-225.eu-west-3.compute.amazonaws.com
login.mail-snel.be |
ASN54113 (FASTLY, US)
resources.digital-cloud-west.medallia.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-49-77-76.deploy.static.akamaitechnologies.com
public.cobrowse.oraclecloud.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
mail-snel.be
login.mail-snel.be |
526 KB |
2 |
medallia.com
resources.digital-cloud-west.medallia.com — Cisco Umbrella Rank: 3773 |
102 KB |
1 |
oraclecloud.com
public.cobrowse.oraclecloud.com — Cisco Umbrella Rank: 16904 |
|
0 |
key.com
Failed
www.key.com Failed |
|
17 | 4 |
Domain | Requested by | |
---|---|---|
12 | login.mail-snel.be |
login.mail-snel.be
|
2 | resources.digital-cloud-west.medallia.com |
login.mail-snel.be
|
1 | public.cobrowse.oraclecloud.com |
login.mail-snel.be
|
0 | www.key.com Failed | |
17 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
l0ginwkeybnkefily.me l0ginwkeybnkefily.me |
2024-05-06 - 2025-05-06 |
a year | crt.sh |
*.digital-cloud-west.medallia.com SSL.com RSA SSL subCA |
2023-11-01 - 2024-12-01 |
a year | crt.sh |
*.cobrowse.oraclecloud.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-04-07 - 2025-04-09 |
a year | crt.sh |
This page contains 3 frames:
Frame:
https://www.key.com/personal/index.jsp
Frame ID: 855A0EBD49D4521B72690ADCEA67D996
Requests: 15 HTTP requests in this frame
Frame:
https://public.cobrowse.oraclecloud.com/rely/storage/ll_storage_html5.html?context=t4t9cksxjhml3cz1ygk&version=20210505
Frame ID: BF9E49083CCE7914662DE3EB50C6F648
Requests: 1 HTTP requests in this frame
Frame:
https://resources.digital-cloud-west.medallia.com/wdcsea/23736/forms/3814/form1623938134585.html?formId=3814&type=live&isMobile=false&referrer=https%3A%2F%2Fibx.key.com%2Fibxolb%2Fforgots%2Findex.html%23%2Funlock-usr®ion=digital-cloud-west&isWCAG=true&displayType=lightbox&isSeparateFormTemplateFromData=true
Frame ID: 77FCBE70EC1F7BB828BA78F85D39A831
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
c.html
login.mail-snel.be/KeyBank/ |
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amt-ui-styles-key.css
login.mail-snel.be/KeyBank/css/ |
8 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
kds-base-key.css
login.mail-snel.be/KeyBank/css/ |
305 KB 305 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibx-globals-key.css
login.mail-snel.be/KeyBank/css/ |
161 B 402 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ifstyles-key.css
login.mail-snel.be/KeyBank/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amt-sdk-styles.css
login.mail-snel.be/KeyBank/css/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ifstyles.333ef4c4f4a519c61f8f.css
login.mail-snel.be/KeyBank/css/ |
168 KB 168 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
key_white_logo.png
login.mail-snel.be/KeyBank/images/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
key_black_logo.png
login.mail-snel.be/KeyBank/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
generic1652491308640.js
resources.digital-cloud-west.medallia.com/wdcwest/23736/onsite/ |
382 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kloader.gif
resources.digital-cloud-west.medallia.com/resources/onsite/images/ |
19 KB 19 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ll_storage_html5.html
public.cobrowse.oraclecloud.com/rely/storage/ Frame BF9E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
form1623938134585.html
resources.digital-cloud-west.medallia.com/wdcsea/23736/forms/3814/ Frame 77FC |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular-webfont.79515ad0788973c53340.woff
login.mail-snel.be/KeyBank/css/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
08edde9d-c27b-4731-a27f-d6cd9b01cd06.woff
login.mail-snel.be/KeyBank/css/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
OpenSans-Regular-webfont.488d5cc145299ba07b75.ttf
login.mail-snel.be/KeyBank/css/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
index.jsp
www.key.com/personal/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- resources.digital-cloud-west.medallia.com
- URL
- https://resources.digital-cloud-west.medallia.com/wdcsea/23736/forms/3814/form1623938134585.html?formId=3814&type=live&isMobile=false&referrer=https%3A%2F%2Fibx.key.com%2Fibxolb%2Fforgots%2Findex.html%23%2Funlock-usr®ion=digital-cloud-west&isWCAG=true&displayType=lightbox&isSeparateFormTemplateFromData=true
- Domain
- www.key.com
- URL
- https://www.key.com/personal/index.jsp
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: KeyBank (Banking)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.mail-snel.be/ | Name: mdLogger Value: false |
|
login.mail-snel.be/ | Name: kampyleUserSession Value: 1716614732759 |
|
login.mail-snel.be/ | Name: kampyleUserSessionsCount Value: 1 |
|
login.mail-snel.be/ | Name: kampyleSessionPageCounter Value: 1 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.mail-snel.be
public.cobrowse.oraclecloud.com
resources.digital-cloud-west.medallia.com
www.key.com
resources.digital-cloud-west.medallia.com
www.key.com
146.75.121.230
23.49.77.76
52.47.86.225
07eeecd82d157b4f6d4147ede1b838e77e5e772e74307a3f53cf9c4afdffa15e
24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90
32eb176e96d79b0b753a7a5753660e0480198f59ac62b6af39d797f905cfdbd6
491843ff4a84c2d844894ea3e553e6e1a8fee7106b45573560a9e16a62ed9b77
60faa14c55c54c28f8a62e03f092f95dfa67af4f3458f3d6ed459fb8cb764396
88875dd7056deb037293ebd0d27ab0419d759e530d07eead4a2d109bf5b576fb
a492a19b35c722e4137b04a8b68170cd856a7d409a634ac5afb0e1028079f4d2
b95d3e4d57d89ce67724a2e61ddfca718dc4966f11d1e134a6a763fed3110a7f
de35a69575718cdee8f4583e969583506939c38f94c0dad37dfe66abe574dbc0
e2d03e141343df04a8cd64ec10ad1e0ba6a700bfca5e23b6f3eb7c92fc055b2f
ff8c405a2ba5efc1d4e6216cc62e30af685c313f0d5706e5af8f1636f6c119f7