![](/screenshots/5734d169-d5b2-4a19-8f1c-ccfc478b4944.png)
cibcsecuritymonitor.net
Open in
urlscan Pro
103.207.42.71
Malicious Activity!
Public Scan
Effective URL: https://cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/index.html
Submission: On October 03 via manual from AP
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 20th 2018. Valid for: 3 months.
This is the only time cibcsecuritymonitor.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: CIBC (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 205.185.125.60 205.185.125.60 | 53667 (PONYNET) (PONYNET - FranTech Solutions) | |
18 | 103.207.42.71 103.207.42.71 | 40676 (AS40676) (AS40676 - Psychz Networks) | |
18 | 1 |
ASN53667 (PONYNET - FranTech Solutions, US)
PTR: tor-proxy-ca01.t04st.net
health.autoavatar.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
cibcsecuritymonitor.net
cibcsecuritymonitor.net |
850 KB |
1 |
autoavatar.com
1 redirects
health.autoavatar.com |
377 B |
18 | 2 |
Domain | Requested by | |
---|---|---|
18 | cibcsecuritymonitor.net |
cibcsecuritymonitor.net
|
1 | health.autoavatar.com | 1 redirects |
18 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cibcsecuritymonitor.net Let's Encrypt Authority X3 |
2018-09-20 - 2018-12-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/index.html
Frame ID: DF0595D7346C1E59E0FD470B2078167E
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/5734d169-d5b2-4a19-8f1c-ccfc478b4944.png)
Page URL History Show full URLs
-
http://health.autoavatar.com/sj/nsb.html?id=impressivenesses
HTTP 302
https://cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/index.html Page URL
Detected technologies
Detected patterns
- headers server /php\/?([\d.]+)?/i
![](/vendor/wappa/icons/CentOS.png)
Detected patterns
- headers server /CentOS/i
![](/vendor/wappa/icons/OpenSSL.png)
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://health.autoavatar.com/sj/nsb.html?id=impressivenesses
HTTP 302
https://cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/ Redirect Chain
|
10 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor.css
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/css/ |
211 KB 211 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ba.css
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/css/ |
444 KB 444 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.3.min.js
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/js/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/js/ |
926 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-presignon.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-presignon-print.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
white-iphone-my-accounts-en.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
40 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-footer-phone.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
420 B 750 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-footer-tools.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
481 B 811 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-footer-rate.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
535 B 865 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-shield.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
695 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ui-popover-help.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
851 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-secure.png
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/img/ |
537 B 867 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glober_regular-webfont.woff2
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/fonts/ |
23 KB 23 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glober_book-webfont.woff2
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glober_book-webfont.woff
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glober_book-webfont.ttf
cibcsecuritymonitor.net/ebm-resources/public/banking/cibc/client/web/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: CIBC (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cibcsecuritymonitor.net
health.autoavatar.com
103.207.42.71
205.185.125.60
052b8fca555be7c80bcb5f47d22f2bab9ab4dc8453d622c578a5d7d4bbcbc8d7
05af26ad67a9084ab2ceacb9c9e14e80d50e8ad8b33682eb9c7c2cdc1f22596d
10b5152ea362e671849724f82eca5c6883354038af2d04e5320fb908cc8f0cdf
22b1695c13f6385ef0626fddfc371dfd479b06d6523a716641334293ba038dd3
2d7fedfb1f1c989bbdd590f7c0d4dd14d99ffcf7d60978ae89b0fc39dae8b598
5507e39a07d39777ed40d3ff8456bff35549b615bdb72e0506bec301488354e5
7022d4c0bb30dbe97806ed4ec568c09967efb338149cdd8926a9cd5ef1de79b6
72bf7117a4f5b6e57df3a2bacff8703dd7f2b8034dd67d2a7f15721114a1af35
8c03eaf20aa2962752be690da34078f6cbbe8db3e1502db1688d017605201193
99f6b625f19f271042d06d8b8fbb6c685d8a53402fc66f09e7e53b42859cf835
9a97a13e3d544edfb941749f83fc29857c1039dd9d0388f3d3b53c9b145f2e6f
b341e9523e94a2607a1051853cfed36b937a3c825ceb507457a89a0de6aeb16a
cdc030cfa3295a46514be8f7b1c142e7d008a94e350c93bd96bc0f464f56173f
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
efefb8475a87181875f605437e898756d2ad7c9bb760e8aa158ee19da6727e1b