klimtop.ro
Open in
urlscan Pro
95.81.171.143
Malicious Activity!
Public Scan
URL:
http://klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/security.php
Submission: On May 21 via automatic, source openphish
Submission: On May 21 via automatic, source openphish
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 15 HTTP transactions.
The main IP is 95.81.171.143, located in
Paris, France and
belongs to TDFPMM, FR.
The main domain is klimtop.ro.
This is the only time klimtop.ro was scanned on urlscan.io!
This is the only time klimtop.ro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 4 14 | 95.81.171.143 95.81.171.143 | 43646 (TDFPMM) (TDFPMM) | |
| 4 | 134.249.116.78 134.249.116.78 | 15895 (KSNET-AS) (KSNET-AS) | |
| 15 | 3 |
4
134.249.116.78
(Lviv, Ukraine)
ASN15895 (KSNET-AS, UA)
PTR: 134-249-116-78.broadband.kyivstar.net
ASN15895 (KSNET-AS, UA)
PTR: 134-249-116-78.broadband.kyivstar.net
| 134.249.116.78 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
klimtop.ro
4 redirects
klimtop.ro |
182 KB |
| 0 |
bankofamerica.com
Failed
chat.bankofamerica.com Failed |
|
| 15 | 2 |
| Domain | Requested by | |
|---|---|---|
| 14 | klimtop.ro |
4 redirects
klimtop.ro
|
| 0 | chat.bankofamerica.com Failed |
klimtop.ro
|
| 15 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.bankofamerica.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/security.php
Frame ID: 2590C615ABBCDE761C579328AFB01837
Requests: 15 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.bankofamerica.com/privacy/
Title: Privacy & Security
Title: Privacy & Security
Search URL Search Domain Scan URL
URL: http://www.bankofamerica.com/help/equalhousing_popup.cfm
Title: Equal Housing Lender
Title: Equal Housing Lender
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- http://klimtop.ro/pa/components/modules/header-module/2.1/graphic/fsd-secure-esp-sprite.png HTTP 302
- http://134.249.116.78/index.php
- http://klimtop.ro/pa/components/modules/quick-help-module/2.0/graphic/fsd-arrows.png HTTP 302
- http://134.249.116.78/index.php
- http://klimtop.ro/pa/components/modules/global-footer-module/2.5/graphic/gfootb-static-sprite.png HTTP 302
- http://134.249.116.78/index.php
- http://klimtop.ro/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png HTTP 302
- http://134.249.116.78/index.php
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
security.php
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/ |
29 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global-jawr.css
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
90 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vipaa-jawr.css
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
184 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global-jawr.js
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vipaa-jawr.js
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
328 KB 85 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
deploy2.js
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
20 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mTag.js
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
17 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bac_reg_logo_tmp_250X69.gif
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
continue.jpg
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mtagconfig.js
klimtop.ro/wordpress/wp-includes/Requests/Auth/BoF/files/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.php
134.249.116.78/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.php
134.249.116.78/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.php
134.249.116.78/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.php
134.249.116.78/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
deploy2.asp
chat.bankofamerica.com/visitor/addons/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- chat.bankofamerica.com
- URL
- http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)135 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask string| boaVIPAAuseGzippedBundles string| boaVIPAAjawrEnabled function| setFlexLayoutFooterHeight undefined| flexLayoutFooterHeightOriginal undefined| flexLayoutCenterContentHeightOriginal undefined| $flexLayoutFooterDiv undefined| $flexLayoutFooterInner undefined| SEP undefined| PAIR function| PM_FP_activeXDetect function| PM_FP_stripIllegalChars function| PM_FP_stripFullPath undefined| PM_FP_BrowserDetect function| PM_FP_FingerPrint function| Hashtable function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| add_deviceprint function| PM_FP_urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_deviceprint_sk function| getBrowserType function| addPassMarkFlash2 undefined| isIE undefined| isWin undefined| isOpera function| ControlVersion function| GetSwfVer function| DetectFlashVer function| AC_AddExtension function| AC_Generateobj function| AC_FL_RunContent function| AC_GetArgs undefined| requiredMajorVersion undefined| requiredMinorVersion undefined| requiredRevision undefined| src undefined| width undefined| height undefined| application undefined| bgcolor function| showWidget undefined| spwSafePassNonFlashUrl undefined| spwPageCode undefined| spwFormName undefined| spwDeviceIndex undefined| spwExpand undefined| spwDivId undefined| spwProgressBarEachPercent undefined| spwContainerID undefined| spwScriptNode undefined| spwLinkNode function| showNonFlashWidget undefined| spwProgressBar function| isBrowserIE function| isBrowserOpera function| getVersionString function| isExternalInterfaceCompatible function| isWidgetCompatible function| isSitekeyWidgetCompatible undefined| $errorMessageContent undefined| boa undefined| $ssnfirst undefined| $ssnmiddle undefined| $ssnlast undefined| onlineidverify undefined| passcodeVerify undefined| $quickHelpBoaLangObj function| loadURL undefined| skmodSiteKeyLoadLimit undefined| skmodSiteKeyDisplayLimit undefined| skmodLastSitekeyDisplayed undefined| skmodDisplayID undefined| skmodImageID undefined| skmodLoadPage undefined| skmodPageIndex undefined| skImgADAText function| skmodLogSKImageError function| skmodUpdateSKImages function| skmodUpdatePreviousNextImages function| skmodClearSKImagesSrc function| skmodClearImageSelection undefined| questionValue undefined| duplicateExists undefined| lpfielderror undefined| requestAuthUrl undefined| requstAuthCode undefined| $popupFsdHeader undefined| cmPageViewForModal undefined| vendorURL undefined| CONTEXT undefined| olbTnCModuleTwoScrollSkin function| validNumeriChars function| isValid function| verifySubmit function| redirectPage function| trimVal function| processCoremetrics function| printContinue function| dualActionClick function| actionSplashParam function| actionECDParam function| actionModalParam function| actionOnlineIDParam undefined| ConversionStageTrim function| hcArrayStorage function| lpRequest function| lpConnectionLibrary object| lpJSLib object| lpConnLib function| lpMonitorTag undefined| lpLazy undefined| lpMTag function| lpJSLibrary object| theBody string| continueURL function| myUrl string| quickHelpRequestURL string| lpUnit string| lpLanguage string| ConversionStage object| lpMTagConfig function| lpAddMonitorTag function| lpSendData function| lpAddVars number| passCodeErrorCounter number| onlineIdErrorCounter function| updateLpCounters function| getSelectedAcctForConvAction0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
chat.bankofamerica.com
klimtop.ro
chat.bankofamerica.com
134.249.116.78
95.81.171.143
0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72
09a54bbb2061a17e8895e42f87442d2ff1648fb89f5246fc64b5eaa9e04fc4f0
15e295aa25dc34c6096bbc1ac5ecfe8a2d3903b5c1ef126222388edae9266383
3d76e5ba2c6ead84f5578ca057b443ebf014eb22d8cd6c756103da606e9234ec
3fda09990a0f8f5d422544c0c4905d65232fb63483b79f8c85a74bc5fd15f051
716d41b4ff253cccbf90f548b06b866d2bb12566ae81fb8fb8eee9380c0144ba
7fa4b8e6a601d0b18b51d24b96cc52e73484bf3ef3daa40cd27f5a4c3d4ab353
cf8bb428d40df9eb7d4f399443cbaacc8bc1bdd598a8828788748ba6fba1be8d
d4db6991fbbff75b76cbdd4cab25608e06caf001746d2f49bbc35dec364339b4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855