www.safeaccountaib.com Open in urlscan Pro
199.188.205.252  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.safeaccountaib.com/	24 KB 7 KB	515ms 167ms	Document text/html	199.188.205.252 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.safeaccountaib.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 199.188.205.252 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server61-5.web-hosting.com Software LiteSpeed / PHP/7.2.34 Resource Hash 02c1d9a5daf4c1462f6006ed8d1751b7b45be6fdffa4c188c6a9670ae4d76529 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-length 7045 content-type text/html; charset=UTF-8 date Sat, 30 Apr 2022 12:29:22 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding x-powered-by PHP/7.2.34 x-turbo-charged-by LiteSpeed
GET H2	200	jquery.js Show response www.safeaccountaib.com/js/	87 KB 30 KB	175ms 174ms	Script application/javascript	199.188.205.252 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.safeaccountaib.com/js/jquery.js Requested by Host: www.safeaccountaib.com URL: https://www.safeaccountaib.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 199.188.205.252 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server61-5.web-hosting.com Software LiteSpeed / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers accept-language de-DE,de;q=0.9 Referer https://www.safeaccountaib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 30 Apr 2022 12:29:22 GMT content-encoding br last-modified Wed, 21 Apr 2021 20:00:21 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 30267 expires Sat, 07 May 2022 12:29:22 GMT
GET H/1.1	200 OK	main.css auth.aib.ie/assets/css/	169 KB 170 KB	189ms 46ms	Stylesheet text/css	194.69.199.12 AIB-AS-1
General Check archive.org Show headers Download Go to Full URL https://auth.aib.ie/assets/css/main.css Requested by Host: www.safeaccountaib.com URL: https://www.safeaccountaib.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 194.69.199.12 Dublin, Ireland, ASN16282 (AIB-AS-1, GB), Reverse DNS Software / Resource Hash 98e5c5e21c76cd216b97778ee3711da0e39fdb8b6ef095bf9489fe4e98114894 Security Headers Name Value Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie; img-src 'self' p.typekit.net https://*.aib.ie; base-uri 'self' https://*.aib.ie; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie Strict-Transport-Security max-age=15552000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.safeaccountaib.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers Date Sat, 30 Apr 2022 12:29:22 GMT Referrer-Policy origin Last-Modified Sat, 26 Oct 1985 08:15:00 GMT Strict-Transport-Security max-age=15552000; includeSubDomains Content-Type text/css Cache-Control max-age=0, must-revalidate Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' use.typekit.net ajax.googleapis.com; style-src 'self' 'unsafe-inline' p.typekit.net use.typekit.net https://*.aib.ie; img-src 'self' p.typekit.net https://*.aib.ie; base-uri 'self' https://*.aib.ie; object-src 'self'; frame-ancestors 'self' https://*.aib.ie https://onlinebanking.ebs.ie Content-Length 173248
GET H2	200	jquery.mask.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/	8 KB 4 KB	46ms 28ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js Requested by Host: www.safeaccountaib.com URL: https://www.safeaccountaib.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.safeaccountaib.com/ Origin https://www.safeaccountaib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 30 Apr 2022 12:29:22 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 6708775 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 3074 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:47 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec3-2087" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wGCH6hsHleN6SCeVWEg06jSYaA7sMlY4by7ZqdRB4egYwyksoE0zG05ReUNsnpmgah896l8PaawEIUNdq2O9dAWnj12kqc%2FRFeTiYLWLNRPqhtsq7YNl1TJy6ZMV5d6Z4Q56nRtkEx3CMtTK5j9KutrZ"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 70404855fc2d9028-FRA expires Thu, 20 Apr 2023 12:29:22 GMT
GET H2	200	ProximaNova-Regular.otf www.safeaccountaib.com/fonts/	61 KB 62 KB	161ms 161ms	Font font/otf	199.188.205.252 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.safeaccountaib.com/fonts/ProximaNova-Regular.otf Requested by Host: www.safeaccountaib.com URL: https://www.safeaccountaib.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 199.188.205.252 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server61-5.web-hosting.com Software LiteSpeed / Resource Hash 2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9 Request headers Referer https://www.safeaccountaib.com/ Origin https://www.safeaccountaib.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 30 Apr 2022 12:29:22 GMT last-modified Wed, 21 Apr 2021 19:05:28 GMT x-turbo-charged-by LiteSpeed server LiteSpeed accept-ranges bytes content-length 62892 content-type font/otf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Allied Irish Banks (Banking)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| $ function| jQuery string| ua number| msie object| $jscomp function| aibShowTroubleLoggingInReg function| aibHideTroubleLoggingInReg function| postForgotPassword function| postRecoverUsername function| postAlternateAuthnSystem function| postRegistration function| postOk function| submitForm function| postCancel function| postOnReturn function| setFocus function| setMobile function| getScreenWidth object| bodyTag number| width boolean| remember function| IsWebAuthnSupported function| isWebAuthnPlatformAuthenticatorAvailable function| createCancelCookie

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.safeaccountaib.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 674b1309bbf329300b62557741b4d9be

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.aib.ie
cdnjs.cloudflare.com
www.safeaccountaib.com
194.69.199.12
199.188.205.252
2606:4700::6811:180e
02c1d9a5daf4c1462f6006ed8d1751b7b45be6fdffa4c188c6a9670ae4d76529
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
2b80fbe521e07e4e84eb52e707b364c3e6c05c57e483276dc4b3be93a9794ba9
98e5c5e21c76cd216b97778ee3711da0e39fdb8b6ef095bf9489fe4e98114894
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e