www.secure-bank-alerts.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 1 HTTP transactions. The main IP is 52.17.214.64, located in Dublin, Ireland and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.secure-bank-alerts.com.
TLS certificate: Issued by Amazon on May 22nd 2019. Valid for: a year.

This is the only time www.secure-bank-alerts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.210.60.36 52.210.60.36	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.17.214.64 52.17.214.64	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2

1 52.210.60.36 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-210-60-36.eu-west-1.compute.amazonaws.com

xql1lt4n.r.eu-west-1.awstrack.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.214.64 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-17-214-64.eu-west-1.compute.amazonaws.com

www.secure-bank-alerts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	secure-bank-alerts.com www.secure-bank-alerts.com	82 KB
1	awstrack.me 1 redirects xql1lt4n.r.eu-west-1.awstrack.me	640 B
1	2

	Domain	Requested by
1	www.secure-bank-alerts.com
1	xql1lt4n.r.eu-west-1.awstrack.me	1 redirects
1	2

This site contains no links.

Subject Issuer	Validity	Valid
secure-bank-alerts.com Amazon	`2019-05-22` - `2020-06-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJodHRwczovL3Vib3p4eTh0cjkuZXhlY3V0ZS1hcGkuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZjAwNzQ3NDctNzQ1Ni00NzY1LWFhYWEtYzUzYzQ3MDkwODY3IiwidGVzdF90b2tlbiI6ZmFsc2UsImlhdCI6MTU3OTI3MDI3MywiaXNzIjoiaHR0cHM6Ly9hcHAucGhpc2h0aHJlYXQuY29tIiwiZXhwIjoxNTg3MDQ2MjczfQ.v2kwWhZ0H-37e2VWKmYjo8_7hzpeukwJvOGrAcG8TnE
Frame ID: 6DE83D83DC2DE856899729BB5691D68B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://xql1lt4n.r.eu-west-1.awstrack.me/L0/https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFj... HTTP 302
https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctND... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

82 kB
Transfer

215 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://xql1lt4n.r.eu-west-1.awstrack.me/L0/https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJodHRwczovL3Vib3p4eTh0cjkuZXhlY3V0ZS1hcGkuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZjAwNzQ3NDctNzQ1Ni00NzY1LWFhYWEtYzUzYzQ3MDkwODY3IiwidGVzdF90b2tlbiI6ZmFsc2UsImlhdCI6MTU3OTI3MDI3MywiaXNzIjoiaHR0cHM6Ly9hcHAucGhpc2h0aHJlYXQuY29tIiwiZXhwIjoxNTg3MDQ2MjczfQ.v2kwWhZ0H-37e2VWKmYjo8_7hzpeukwJvOGrAcG8TnE/2/0102016fb3d7f820-db6a6bea-d025-462b-9ddf-895b4657b932-000000/-c5j-dhr30HdBx3wiI21-Y_Q07E=145 HTTP 302
https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJodHRwczovL3Vib3p4eTh0cjkuZXhlY3V0ZS1hcGkuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZjAwNzQ3NDctNzQ1Ni00NzY1LWFhYWEtYzUzYzQ3MDkwODY3IiwidGVzdF90b2tlbiI6ZmFsc2UsImlhdCI6MTU3OTI3MDI3MywiaXNzIjoiaHR0cHM6Ly9hcHAucGhpc2h0aHJlYXQuY29tIiwiZXhwIjoxNTg3MDQ2MjczfQ.v2kwWhZ0H-37e2VWKmYjo8_7hzpeukwJvOGrAcG8TnE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request signin Show response www.secure-bank-alerts.com/ Redirect Chain https://xql1lt4n.r.eu-west-1.awstrack.me/L0/https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJo... https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJodHRwczovL3Vib3p4eTh0cjkuZXhlY3V0ZS1hcGkuZXUt...	158 KB 82 KB	1524ms 1403ms	Document text/html	52.17.214.64 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJodHRwczovL3Vib3p4eTh0cjkuZXhlY3V0ZS1hcGkuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZjAwNzQ3NDctNzQ1Ni00NzY1LWFhYWEtYzUzYzQ3MDkwODY3IiwidGVzdF90b2tlbiI6ZmFsc2UsImlhdCI6MTU3OTI3MDI3MywiaXNzIjoiaHR0cHM6Ly9hcHAucGhpc2h0aHJlYXQuY29tIiwiZXhwIjoxNTg3MDQ2MjczfQ.v2kwWhZ0H-37e2VWKmYjo8_7hzpeukwJvOGrAcG8TnE Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.17.214.64 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-17-214-64.eu-west-1.compute.amazonaws.com Software nginx/1.16.1 / Resource Hash `600c2630ae67709ac051f8e72b37b8d56cafb8af4871a5e194b7b5e44a493a02` Request headers Host www.secure-bank-alerts.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Sec-Fetch-Mode navigate Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Response headers Date Sat, 18 Jan 2020 07:29:26 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Server nginx/1.16.1 Content-Encoding gzip X-rq lhr1 102 212 3177 Cache-Control max-age=300, must-revalidate Age 0 X-Cache miss Vary Accept-Encoding Accept-Ranges bytes Redirect headers Date Sat, 18 Jan 2020 07:29:24 GMT Location https://www.secure-bank-alerts.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJhY2MyZmVjLWI4NjctNDk0Yi04YTFiLWVlMGFlYTNkZjIxMCIsImNlbGwiOiJodHRwczovL3Vib3p4eTh0cjkuZXhlY3V0ZS1hcGkuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZjAwNzQ3NDctNzQ1Ni00NzY1LWFhYWEtYzUzYzQ3MDkwODY3IiwidGVzdF90b2tlbiI6ZmFsc2UsImlhdCI6MTU3OTI3MDI3MywiaXNzIjoiaHR0cHM6Ly9hcHAucGhpc2h0aHJlYXQuY29tIiwiZXhwIjoxNTg3MDQ2MjczfQ.v2kwWhZ0H-37e2VWKmYjo8_7hzpeukwJvOGrAcG8TnE Server Apache-Coyote/1.1 Content-Length 0 Connection keep-alive
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `02ff0105ff0649e9b6fce3f8e0842d5cb5db180a86739641409f71c4a4681c23` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	473 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e1ac56ae25629e508f729b799d563d71920902a4cb26cf3bb602beb3e368775e` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2a1b1589e316d02ab75481e7aa88c9975afd2e87f17982fb6d38b6ebe2425a4c` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	48 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	144 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a8bc6337547a246ef75d1ae66d7ec8a0ed6171c1ba49804a403124e27c8e8452` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.secure-bank-alerts.com
xql1lt4n.r.eu-west-1.awstrack.me
52.17.214.64
52.210.60.36
02ff0105ff0649e9b6fce3f8e0842d5cb5db180a86739641409f71c4a4681c23
2a1b1589e316d02ab75481e7aa88c9975afd2e87f17982fb6d38b6ebe2425a4c
600c2630ae67709ac051f8e72b37b8d56cafb8af4871a5e194b7b5e44a493a02
8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01
a8bc6337547a246ef75d1ae66d7ec8a0ed6171c1ba49804a403124e27c8e8452
ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4
e1ac56ae25629e508f729b799d563d71920902a4cb26cf3bb602beb3e368775e

www.secure-bank-alerts.com Open in urlscan Pro 52.17.214.64 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

82 kBTransfer

215 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

www.secure-bank-alerts.com Open in urlscan Pro
52.17.214.64 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

82 kB
Transfer

215 kB
Size

0
Cookies

1 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!