finance.faberhost.web.id
Open in
urlscan Pro
202.78.200.40
Malicious Activity!
Public Scan
Submission: On June 12 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 2nd 2023. Valid for: 3 months.
This is the only time finance.faberhost.web.id was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 14 | 202.78.200.40 202.78.200.40 | 18059 (DTPNET-AS...) (DTPNET-AS-AP DTPNET NAP) | |
13 | 1 |
ASN18059 (DTPNET-AS-AP DTPNET NAP, ID)
PTR: emerald.faberhostserver.com
finance.faberhost.web.id |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
faberhost.web.id
1 redirects
finance.faberhost.web.id |
124 KB |
13 | 1 |
Domain | Requested by | |
---|---|---|
14 | finance.faberhost.web.id |
1 redirects
finance.faberhost.web.id
|
13 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
finance.faberhost.web.id cPanel, Inc. Certification Authority |
2023-05-02 - 2023-07-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://finance.faberhost.web.id/mexi/
Frame ID: C701D7F95C6A769FCA47E0D23814145B
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Banca en LĂneaPage URL History Show full URLs
-
https://finance.faberhost.web.id/mexi
HTTP 301
https://finance.faberhost.web.id/mexi/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://finance.faberhost.web.id/mexi
HTTP 301
https://finance.faberhost.web.id/mexi/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
finance.faberhost.web.id/mexi/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
normalize.min.css
finance.faberhost.web.id/mexi/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
estilos.css
finance.faberhost.web.id/mexi/css/ |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.jpg
finance.faberhost.web.id/mexi/img/ |
5 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock.jpg
finance.faberhost.web.id/mexi/img/ |
368 B 610 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
points.jpg
finance.faberhost.web.id/mexi/img/ |
287 B 530 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
help.jpg
finance.faberhost.web.id/mexi/img/ |
793 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
movil.jpg
finance.faberhost.web.id/mexi/img/ |
8 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sign-in-sprite.jpg
finance.faberhost.web.id/mexi/img/ |
628 B 870 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock2.jpg
finance.faberhost.web.id/mexi/img/ |
544 B 787 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
line.jpg
finance.faberhost.web.id/mexi/img/ |
389 B 631 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
casa.jpg
finance.faberhost.web.id/mexi/img/ |
497 B 739 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cnx-regular.woff
finance.faberhost.web.id/mexi/fonts/ |
82 KB 83 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
finance.faberhost.web.id
202.78.200.40
0987feefba7999ef945bbeb1676c58cc167bf5e768779c6cacd9331713141249
09ba75e6ebf66deddedc677311ff8ecc7a4d305c59122d1dde290e7c103a5a85
1172386e1cd9f7fd9d7646df035d93473bbbf19e1b325fc54d9c2aa76e5a7a80
14a615e9c447380dd58053a0e6d9f6a54a6303fa10db77d9e4043724221fe497
1a22d1fce65eecd95d5169d5404f4b832c2868c30380867823678313df9b2dea
6e45e6773ed14ea91e91dccb10ab8e752367c010ae1175fc5adeb1432390bc71
6e86c9f751bf269fc5c7e41684c55939750d36e002c0a4049f1a33b31cb383cc
77bc1d3909183b5c0cd2f438d865b2fc290c1fb1d978bc4bb52c006db3fcab27
831a3c42a161e708ad2ab80fcd7fbc67e03d644f6d5affcc6be55844f3345c41
989fb6818c0561c45b13fbb5446e5dda44d46c6cf5e8ae6ac6e32ad7dc0cf40b
d2473944f721eaad91fee76e240f71689dc22636301267de22a19aa3ab618f1f
eb186852800917b3c23a54935991893eda4bfb6377761ea27190ff246bb9e6f7
fa0556ee9fa28f039b38b77476bc7754aeb9a948ed669ddeef858d0604064b1d