sco01bank-sec02link.com Open in urlscan Pro
94.242.227.50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Submission: On February 03 via manual (February 3rd 2019, 6:06:55 pm UTC) from CA

Summary HTTP 16 Redirects Links 3 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 94.242.227.50, located in Luxembourg and belongs to ROOT, LU. The main domain is sco01bank-sec02link.com.

This is the only time sco01bank-sec02link.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Scotiabank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
7	94.242.227.50 94.242.227.50		5577 (ROOT) (ROOT)
7	2.19.41.92 2.19.41.92		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:806::2008		15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81a::2003		15169 (GOOGLE) (GOOGLE - Google LLC)
16	4

7 94.242.227.50 (Luxembourg)

ASN5577 (ROOT, LU)
PTR: cat17.ipchina163.com

sco01bank-sec02link.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.19.41.92 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-41-92.deploy.static.akamaitechnologies.com

mobilebanking4.scotiabank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	scotiabank.com mobilebanking4.scotiabank.com	51 KB
7	sco01bank-sec02link.com sco01bank-sec02link.com	863 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	googletagmanager.com www.googletagmanager.com
16	4

	Domain	Requested by
7	mobilebanking4.scotiabank.com	sco01bank-sec02link.com
7	sco01bank-sec02link.com	sco01bank-sec02link.com
1	fonts.gstatic.com	sco01bank-sec02link.com
1	www.googletagmanager.com	sco01bank-sec02link.com
16	4

This site contains links to these domains. Also see Links.

Domain
mobilebanking1.scotiabank.com
www.scotiabank.com
www1.scotiaonline.scotiabank.com

Subject Issuer	Validity	Valid
mobilebanking.scotiabank.com Entrust Certification Authority - L1K	`2016-02-23` - `2019-02-23`	3 years	crt.sh
*.google.com Google Internet Authority G3	`2019-01-15` - `2019-04-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Frame ID: B6EF7BA302BB11BB966122CA309600FC
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^requirejs$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Modernizr$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

16
Requests

50 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

930 kB
Transfer

1128 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://mobilebanking1.scotiabank.com/
Title: Classic Scotiabank Mobile Website

Search URL Search Domain Scan URL

URL: http://www.scotiabank.com/ca/en/0,,317,00.html
Title: iOS/Android apps

Search URL Search Domain Scan URL

URL: https://www1.scotiaonline.scotiabank.com/online/authentication/authentication.bns
Title: Scotia OnLine

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Scotiabank-BankingWeb.html Show response
sco01bank-sec02link.com/ 16 KB
16 KB 524ms
436ms Document
text/html 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to

Full URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: 7c0fd0be468a611f0cd72599ed62719af766b9c2e7311bf68f73c565be51553b

Request headers

Host: sco01bank-sec02link.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:36 GMT
Server: Apache
Last-Modified: Tue, 17 Apr 2018 09:38:06 GMT
Accept-Ranges: bytes
Content-Length: 16328
Keep-Alive: timeout=3, max=10
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK css.css
mobilebanking4.scotiabank.com/bankingweb/css/ 236 KB
38 KB 742ms
641ms Stylesheet
text/css 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a4bdb96b753b074042b4f6bba5a25fd0dd39e410dd1599783329319ebf32b0e8

Request headers

Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:38 GMT
Content-Encoding: gzip
Last-Modified: Sat, 29 Sep 2018 09:22:47 GMT
ETag: "1e04a-3aff8-576ff1d7ca7c0"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 39008

GET
H/1.1 200
OK scripts.js Show response
sco01bank-sec02link.com/files/ 778 KB
779 KB 227ms
177ms Script
application/javascript 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to

Full URL: http://sco01bank-sec02link.com/files/scripts.js
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: af2f544a6c0fe78d7cdafd87b1bf2d65865c6823070fb88f029a8eb7851d1621

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:37 GMT
Last-Modified: Sun, 15 Apr 2018 00:01:36 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=9
Content-Length: 796947

GET
H/1.1 200
OK logo.svg
sco01bank-sec02link.com/files/ 12 KB
12 KB 210ms
137ms Image
image/svg+xml 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sco01bank-sec02link.com/files/logo.svg
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: 64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:37 GMT
Last-Modified: Sun, 15 Apr 2018 00:01:36 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=10
Content-Length: 12496

GET
H/1.1 200
OK login-logo.svg
mobilebanking4.scotiabank.com/bankingweb/images/en/ 6 KB
3 KB 719ms
613ms Image
image/svg+xml 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/images/en/login-logo.svg
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5ad959fa5edbc9d44fc4b1a32e006395e9cd1f65b441dc8dc0de6e33e7cc6f50

Request headers

Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:38 GMT
Content-Encoding: gzip
Last-Modified: Sat, 29 Sep 2018 09:22:47 GMT
ETag: "1e058-184e-576ff1d7ca7c0"
Vary: Accept-Encoding,User-Agent
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2920

GET
H/1.1 200
OK bd-1-29 Show response
sco01bank-sec02link.com/files/ 54 KB
54 KB 71ms
71ms Script
text/plain 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to

Full URL: http://sco01bank-sec02link.com/files/bd-1-29
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: 0e3ca5ff965bf78ca037fe0bb07e7e0e3af713b327a411068b2ca5f0abc3cdd0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:37 GMT
Last-Modified: Sun, 15 Apr 2018 00:01:36 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=9
Content-Length: 54971

GET
H/1.1 404
Not Found gtm.js
www.googletagmanager.com/ 0
0 35ms
14ms Script
text/html 2a00:1450:4001:806::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Server: 2a00:1450:4001:806::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

GET
H2 200 MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2
fonts.gstatic.com/s/lato/v11/ 16 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81a::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v11/MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2

Requested by

Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81a::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
Origin: http://sco01bank-sec02link.com

Response headers

date: Wed, 19 Dec 2018 23:22:10 GMT
x-content-type-options: nosniff
last-modified: Mon, 06 Oct 2014 20:38:14 GMT
server: sffe
age: 3955469
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 16436
x-xss-protection: 1; mode=block
expires: Thu, 19 Dec 2019 23:22:10 GMT

GET
H/1.1 200
OK star-inactive.svg
mobilebanking4.scotiabank.com/bankingweb/images/ 641 B
733 B 129ms
129ms Image
image/svg+xml 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/images/star-inactive.svg
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f590c73cb4cce139d760ffa1076e5209d9b6fddde78af655caf3c1432915c3c3

Request headers

Referer: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:39 GMT
Content-Encoding: gzip
Last-Modified: Sat, 29 Sep 2018 09:22:47 GMT
ETag: "1e052-281-576ff1d7ca7c0"
Vary: Accept-Encoding,User-Agent
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 444

GET
H/1.1 200
OK location.png
mobilebanking4.scotiabank.com/bankingweb/images/ 2 KB
2 KB 322ms
322ms Image
image/png 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/images/location.png
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: efcdb0e42c7784a8616d552f3c3766469b93bf10417317b8f0e345ef78a41adc

Request headers

Referer: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:39 GMT
X-Pad: avoid browser bug
Last-Modified: Sat, 29 Sep 2018 09:22:48 GMT
ETag: "1e08b-664-576ff1d8bea00"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1636

GET
H/1.1 200
OK contact.png
mobilebanking4.scotiabank.com/bankingweb/images/ 3 KB
3 KB 203ms
118ms Image
image/png 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/images/contact.png
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: add135c92d06cb337bed1a9deb48a7314d1515e740b803f6f212b6c6e3f5e8d8

Request headers

Referer: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:39 GMT
X-Pad: avoid browser bug
Last-Modified: Sat, 29 Sep 2018 09:22:48 GMT
ETag: "1e0ba-b90-576ff1d8bea00"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2960

GET
H/1.1 200
OK guarantee.png
mobilebanking4.scotiabank.com/bankingweb/images/ 2 KB
2 KB 475ms
377ms Image
image/png 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/images/guarantee.png
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: aeb30c8297029f67ba2c4690149632b298b61532354e4e0a33d7317a0bf46743

Request headers

Referer: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:40 GMT
X-Pad: avoid browser bug
Last-Modified: Sat, 29 Sep 2018 09:22:39 GMT
ETag: "1bd80-7b0-576ff1d0295c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1968

GET
H/1.1 200
OK verify.png
mobilebanking4.scotiabank.com/bankingweb/images/ 2 KB
2 KB 477ms
378ms Image
image/png 2.19.41.92
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mobilebanking4.scotiabank.com/bankingweb/images/verify.png
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.41.92 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-92.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9afe1a03094d6b8f21b297c49c3204d34167974f2fe905f22f70bb62f06c1305

Request headers

Referer: https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 03 Feb 2019 18:06:40 GMT
X-Pad: avoid browser bug
Last-Modified: Sat, 29 Sep 2018 09:22:39 GMT
ETag: "1bd94-752-576ff1d0295c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1874

POST
H/1.1 404
Not Found _data Show response
sco01bank-sec02link.com/_bm/ 326 B
525 B 23ms
23ms XHR
text/html 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to

Full URL: http://sco01bank-sec02link.com/_bm/_data
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/files/bd-1-29
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: 5aa6367c479c5b3ecdcce9de3589bbc9332a9dc0e235f69ebefc1e2269e04dca

Request headers

Pragma: no-cache
Origin: http://sco01bank-sec02link.com
Accept-Encoding: gzip, deflate
Host: sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Cache-Control: no-cache
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Connection: keep-alive
Content-Length: 944
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Origin: http://sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sun, 03 Feb 2019 18:06:38 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=3, max=8
Content-Length: 326
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found translation.json Show response
sco01bank-sec02link.com/locales/en-US/ 347 B
546 B 14ms
14ms XHR
text/html 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to

Full URL: http://sco01bank-sec02link.com/locales/en-US/translation.json?_=1549217199582
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/files/scripts.js
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: 3a85e78ec570e64d781ed147df40c8f813b5954d1614696abd0483c7cd8c806d

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type: application/x-www-form-urlencoded;charset=UTF-8
accept: */*
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Connection: keep-alive
Cache-Control: no-cache
accept: */*
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

Date: Sun, 03 Feb 2019 18:06:38 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=3, max=8
Content-Length: 347
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found translation.json Show response
sco01bank-sec02link.com/locales/en/ 344 B
544 B 23ms
22ms XHR
text/html 94.242.227.50
ROOT

General

Check archive.org

Show headers Download Go to

Full URL: http://sco01bank-sec02link.com/locales/en/translation.json?_=1549217199582
Requested by: Host: sco01bank-sec02link.com
URL: http://sco01bank-sec02link.com/files/scripts.js
Protocol: HTTP/1.1
Server: 94.242.227.50 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS: cat17.ipchina163.com
Software: Apache /
Resource Hash: 0acc47e8109a57431ecc26f7835a52824fbef922c913d3a89907df07bcc3c7d4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sco01bank-sec02link.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type: application/x-www-form-urlencoded;charset=UTF-8
accept: */*
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
Connection: keep-alive
Cache-Control: no-cache
accept: */*
Referer: http://sco01bank-sec02link.com/Scotiabank-BankingWeb.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

Date: Sun, 03 Feb 2019 18:06:38 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=3, max=10
Content-Length: 344
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| dataLayer function| requirejs function| require function| define function| $ function| jQuery object| html5 object| Modernizr object| Foundation object| usedVer object| BnsTmxLoader object| _cf object| _ac object| cf string| _sd_trace object| BankingJS string| feature

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
mobilebanking4.scotiabank.com
sco01bank-sec02link.com
www.googletagmanager.com
2.19.41.92
2a00:1450:4001:806::2008
2a00:1450:4001:81a::2003
94.242.227.50
0acc47e8109a57431ecc26f7835a52824fbef922c913d3a89907df07bcc3c7d4
0e3ca5ff965bf78ca037fe0bb07e7e0e3af713b327a411068b2ca5f0abc3cdd0
3a85e78ec570e64d781ed147df40c8f813b5954d1614696abd0483c7cd8c806d
5aa6367c479c5b3ecdcce9de3589bbc9332a9dc0e235f69ebefc1e2269e04dca
5ad959fa5edbc9d44fc4b1a32e006395e9cd1f65b441dc8dc0de6e33e7cc6f50
64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1
7c0fd0be468a611f0cd72599ed62719af766b9c2e7311bf68f73c565be51553b
9afe1a03094d6b8f21b297c49c3204d34167974f2fe905f22f70bb62f06c1305
a4bdb96b753b074042b4f6bba5a25fd0dd39e410dd1599783329319ebf32b0e8
add135c92d06cb337bed1a9deb48a7314d1515e740b803f6f212b6c6e3f5e8d8
aeb30c8297029f67ba2c4690149632b298b61532354e4e0a33d7317a0bf46743
af2f544a6c0fe78d7cdafd87b1bf2d65865c6823070fb88f029a8eb7851d1621
b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f
efcdb0e42c7784a8616d552f3c3766469b93bf10417317b8f0e345ef78a41adc
f590c73cb4cce139d760ffa1076e5209d9b6fddde78af655caf3c1432915c3c3