xeigjw.com Open in urlscan Pro
185.99.2.117 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://xeigjw.com/bendigoo/bankingbendigobank.htm
Submission: On May 03 via automatic, source openphish (May 3rd 2019, 6:10:43 am UTC)

Summary HTTP 22 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 22 HTTP transactions. The main IP is 185.99.2.117, located in Bosnia & Herzegovina and belongs to GLOBALHOST-BOSNIA-AS, BA. The main domain is xeigjw.com.

This is the only time xeigjw.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bendigo Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4	185.99.2.117 185.99.2.117	200698 (GLOBALHOS...) (GLOBALHOST-BOSNIA-AS)
13	103.211.241.30 103.211.241.30	45852 (BENDIGOBA...) (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited)
1	40.69.200.41 40.69.200.41	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
22	4

4 185.99.2.117 (Bosnia & Herzegovina)

ASN200698 (GLOBALHOST-BOSNIA-AS, BA)
PTR: 06fgl.revoleadsmarket.space

xeigjw.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 103.211.241.30 (Bendigo, Australia)

ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU)
PTR: banking.bendigobank.com.au

banking.bendigobank.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.69.200.41 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

monstat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	bendigobank.com.au banking.bendigobank.com.au	115 KB
4	xeigjw.com xeigjw.com	17 KB
1	monstat.com monstat.com	300 B
22	3

	Domain	Requested by
13	banking.bendigobank.com.au	xeigjw.com
4	xeigjw.com	banking.bendigobank.com.au
1	monstat.com	xeigjw.com
22	3

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
www.google.com
demo.bendigobank.com.au
www.bendigobank.com.au
itunes.apple.com
play.google.com

Subject Issuer	Validity	Valid
banking.bendigobank.com.au Entrust Certification Authority - L1M	`2018-05-24` - `2019-05-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Frame ID: 6118087F997A1F45BE01840589446087
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

22
Requests

59 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

133 kB
Transfer

320 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.microsoft.com/en-au/download/internet-explorer.aspx
Title: update your browser

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/en/chrome/browser/
Title: Google Chrome

Search URL Search Domain Scan URL

URL: https://demo.bendigobank.com.au/
Title: Take a tour

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/personal/ways-to-bank/online-banking
Title: Register

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/help/e-banking-help/mobile-e-banking/latest-changes#113294
Title: What's new

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/help/e-banking-help
Title: Online support

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/security/online-security
Title: Banking securely

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/public/personal/ways-to-bank/real-time-payments

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/au/app/bendigo-bank/id482844929?mt=8
Title: iTunes App Store

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.bendigobank.mobile
Title: Google Play Store

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/public/disclosure-documents
Title: Disclosure documents

Search URL Search Domain Scan URL

URL: https://www.bendigobank.com.au/public/privacy-policy
Title: Privacy policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request bankingbendigobank.htm Show response
xeigjw.com/bendigoo/ 16 KB
16 KB 111ms
40ms Document
text/html 185.99.2.117
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Server: 185.99.2.117 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS: 06fgl.revoleadsmarket.space
Software: Apache /
Resource Hash: c46339ccb9fb376c9c9b59b03e7efb8f338a6f69c222fc07fae256ccf8d203e6

Request headers

Host: xeigjw.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 03 May 2019 06:10:19 GMT
Server: Apache
Last-Modified: Fri, 03 May 2019 01:03:21 GMT
Accept-Ranges: bytes
Content-Length: 15926
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK site_v2.css
banking.bendigobank.com.au/static/assets/stylesheets/ 17 KB
4 KB 2733ms
333ms Stylesheet
text/css 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/static/assets/stylesheets/site_v2.css
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 631f8624ee8734fb91bc885e259dc2aeb94a90c4e61736267371328e0813d380

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Sun, 18 Mar 2018 23:40:42 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: text/css

GET
H/1.1 200
OK outage_info.js Show response
banking.bendigobank.com.au/static/javascript/ 158 B
391 B 2735ms
332ms Script
application/x-javascript 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/static/javascript/outage_info.js
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 940f801632e189492d6ea9b6da03c2bd61fe4a7208c39397e87f1d783bbe78d3

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: application/x-javascript

GET
H/1.1 200
OK site.js Show response
banking.bendigobank.com.au/static/assets/javascripts/ 86 KB
31 KB 2750ms
344ms Script
application/x-javascript 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/static/assets/javascripts/site.js
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: f6f888500b192e7c5e94c9029fdcc49f32ee2b3915ce760d12a81ada704fbd4c

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: application/x-javascript

GET
H/1.1 200
OK application-c1b45de1.js Show response
banking.bendigobank.com.au/static/assets/javascripts/ 93 KB
34 KB 2756ms
346ms Script
application/x-javascript 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/static/assets/javascripts/application-c1b45de1.js
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 89e3370e4bf47401c26e21344ddd8e3b7a2e3e1c961b4726958a31f5970e490e

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: application/x-javascript

GET
H/1.1 200
OK hashtable.js Show response
banking.bendigobank.com.au/static/assets/javascripts/ 14 KB
4 KB 2758ms
347ms Script
application/x-javascript 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/static/assets/javascripts/hashtable.js
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 138143108101149f64bcda5fe38cdd2f3f2139cc957b45949e71fac33ea94482

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Wed, 10 Oct 2018 00:47:34 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: application/x-javascript

GET
H/1.1 200
OK rsa.js Show response
banking.bendigobank.com.au/static/assets/javascripts/ 37 KB
11 KB 3105ms
692ms Script
application/x-javascript 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/static/assets/javascripts/rsa.js
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 98dd64e545863c785de22773cb7e78590488d376c309a348b5b142775ae32277

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Wed, 10 Oct 2018 00:47:34 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: application/x-javascript

GET
H/1.1 200
OK oamSubmit.js.page Show response
banking.bendigobank.com.au/Logon/javax.faces.resource/ 2 KB
1 KB 3069ms
337ms Script
application/javascript 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.bendigobank.com.au/Logon/javax.faces.resource/oamSubmit.js.page?ln=org.apache.myfaces
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: / Servlet/3.0
Resource Hash: 3f74a07b889b162944d9612b74414a93c74e878dc8179f70a92af0bb5287cf05

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Wed, 21 Mar 2018 01:18:22 GMT
x-powered-by: Servlet/3.0
transfer-encoding: chunked
content-language: en-AU
p3p: CP="NON CUR OTPi OUR NOR UNI"
content-type: application/javascript
expires: Fri, 10 May 2019 06:10:22 GMT

GET
H/1.1 200
OK osko-100.png
banking.bendigobank.com.au/static/assets/images/ 15 KB
14 KB 337ms
335ms Image
image/png 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banking.bendigobank.com.au/static/assets/images/osko-100.png
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 91949f98715ab667e28b3e2333df5a83eacbde20f8a12e21d83a9c931115f0e5

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:22 GMT
content-encoding: gzip
last-modified: Tue, 05 Jun 2018 01:46:36 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: text/plain

GET
H/1.1 200
OK bendigobank.png
monstat.com/ 0
300 B 85ms
36ms Image
image/png 40.69.200.41
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://monstat.com/bendigobank.png?du=http%3A//xeigjw.com/bendigoo/bankingbendigobank.htm&dr=&rr=0.4016679038264579

Requested by

Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm

Protocol

HTTP/1.1

Server

40.69.200.41 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY, SAMEORIGIN, SAMEORIGIN

Request headers

Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 03 May 2019 06:10:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 01 Aug 2018 11:22:35 GMT
Server: Apache
X-Frame-Options: DENY, SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 0

GET
H/1.1 200
OK logo-ben.svg
banking.bendigobank.com.au/static/assets/images/ 11 KB
5 KB 344ms
342ms Image
image/svg+xml 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banking.bendigobank.com.au/static/assets/images/logo-ben.svg
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: fbfb5178ef1a29310093b5ee868197a78e357ddee9fd0bf92f766901e785da89

Request headers

Referer: https://banking.bendigobank.com.au/static/assets/stylesheets/site_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:23 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: image/svg+xml

GET
H/1.1 200
OK phone.svg
banking.bendigobank.com.au/static/assets/images/ 822 B
696 B 337ms
336ms Image
image/svg+xml 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banking.bendigobank.com.au/static/assets/images/phone.svg
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 7da20f61f0172701b20a1bd4096276b3275a6198f7eb65fff783b7748ee5d268

Request headers

Referer: https://banking.bendigobank.com.au/static/assets/stylesheets/site_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:23 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: image/svg+xml

GET
H/1.1 200
OK lock.svg
banking.bendigobank.com.au/static/assets/images/ 1 KB
816 B 334ms
333ms Image
image/svg+xml 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banking.bendigobank.com.au/static/assets/images/lock.svg
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: eb4b21e75c9965646dff09688b762c94501e0250fe8e71b631b5f9acfcf8cccb

Request headers

Referer: https://banking.bendigobank.com.au/static/assets/stylesheets/site_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:23 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: image/svg+xml

GET proximanova-regular.woff
banking.bendigobank.com.au/static/assets/fonts/ 0
0

GET proximanova-semibold.woff
banking.bendigobank.com.au/static/assets/fonts/ 0
0

GET
H/1.1 200
OK itunes.svg
banking.bendigobank.com.au/static/assets/images/ 19 KB
8 KB 349ms
349ms Image
image/svg+xml 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banking.bendigobank.com.au/static/assets/images/itunes.svg
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 2cef603909dde61f26c62d596d2862f07c68012fa44a0f2fe443d227b8ed1b0d

Request headers

Referer: https://banking.bendigobank.com.au/static/assets/stylesheets/site_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:23 GMT
content-encoding: gzip
last-modified: Fri, 02 Jun 2017 04:48:26 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: image/svg+xml

GET
H/1.1 200
OK google-play-badge.svg
banking.bendigobank.com.au/static/assets/images/ 7 KB
3 KB 330ms
330ms Image
image/svg+xml 103.211.241.30
BENDIGOBANK-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banking.bendigobank.com.au/static/assets/images/google-play-badge.svg
Requested by: Host: xeigjw.com
URL: http://xeigjw.com/bendigoo/bankingbendigobank.htm
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 103.211.241.30 Bendigo, Australia, ASN45852 (BENDIGOBANK-AS-AP Bendigo and Adelaide Bank Limited, AU),
Reverse DNS: banking.bendigobank.com.au
Software: /
Resource Hash: 16ae0de21ae8e4f8e93edf34ba51dbb54a6cb3f632cac7e4dabd08a4477b7834

Request headers

Referer: https://banking.bendigobank.com.au/static/assets/stylesheets/site_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 03 May 2019 06:10:23 GMT
content-encoding: gzip
last-modified: Tue, 09 Jan 2018 22:58:10 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
transfer-encoding: chunked
content-type: image/svg+xml

GET
H/1.1 404
Not Found warning.html Show response
xeigjw.com/static/assets/html/ 348 B
548 B 41ms
40ms XHR
text/html 185.99.2.117
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xeigjw.com/static/assets/html/warning.html?v=1556863823779
Requested by: Host: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/javascripts/application-c1b45de1.js
Protocol: HTTP/1.1
Server: 185.99.2.117 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS: 06fgl.revoleadsmarket.space
Software: Apache /
Resource Hash: 8fab79ac8bf215200bcf0e6eea6d23e9a2dbb69a229b434a95fa51ee84532328

Request headers

Accept: */*
Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 03 May 2019 06:10:23 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 348
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found securityMessages.html Show response
xeigjw.com/static/assets/html/ 357 B
557 B 82ms
41ms XHR
text/html 185.99.2.117
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xeigjw.com/static/assets/html/securityMessages.html?v=1556863823779
Requested by: Host: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/javascripts/application-c1b45de1.js
Protocol: HTTP/1.1
Server: 185.99.2.117 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS: 06fgl.revoleadsmarket.space
Software: Apache /
Resource Hash: 47845182c3dd27a904738f791723b2ebbe12ad6331b29e85ddfb6e03a30de822

Request headers

Accept: */*
Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 03 May 2019 06:10:23 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 357
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found campaign.html Show response
xeigjw.com/static/assets/html/ 349 B
550 B 101ms
39ms XHR
text/html 185.99.2.117
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xeigjw.com/static/assets/html/campaign.html?v=1556863823779
Requested by: Host: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/javascripts/application-c1b45de1.js
Protocol: HTTP/1.1
Server: 185.99.2.117 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS: 06fgl.revoleadsmarket.space
Software: Apache /
Resource Hash: b10cb773ffe9487c981f670d7292f264b3c384b6a6e3f5b7196d9a6c287ec336

Request headers

Accept: */*
Referer: http://xeigjw.com/bendigoo/bankingbendigobank.htm
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 03 May 2019 06:10:23 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 349
Content-Type: text/html; charset=iso-8859-1

GET proximanova-regular.ttf
banking.bendigobank.com.au/static/assets/fonts/ 0
0

GET proximanova-semibold.ttf
banking.bendigobank.com.au/static/assets/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/fonts/proximanova-regular.woff

Domain: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/fonts/proximanova-semibold.woff

Domain: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/fonts/proximanova-regular.ttf

Domain: banking.bendigobank.com.au
URL: https://banking.bendigobank.com.au/static/assets/fonts/proximanova-semibold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bendigo Bank (Banking)

70 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

banking.bendigobank.com.au
monstat.com
xeigjw.com
banking.bendigobank.com.au
103.211.241.30
185.99.2.117
40.69.200.41
138143108101149f64bcda5fe38cdd2f3f2139cc957b45949e71fac33ea94482
16ae0de21ae8e4f8e93edf34ba51dbb54a6cb3f632cac7e4dabd08a4477b7834
2cef603909dde61f26c62d596d2862f07c68012fa44a0f2fe443d227b8ed1b0d
3f74a07b889b162944d9612b74414a93c74e878dc8179f70a92af0bb5287cf05
47845182c3dd27a904738f791723b2ebbe12ad6331b29e85ddfb6e03a30de822
631f8624ee8734fb91bc885e259dc2aeb94a90c4e61736267371328e0813d380
7da20f61f0172701b20a1bd4096276b3275a6198f7eb65fff783b7748ee5d268
89e3370e4bf47401c26e21344ddd8e3b7a2e3e1c961b4726958a31f5970e490e
8fab79ac8bf215200bcf0e6eea6d23e9a2dbb69a229b434a95fa51ee84532328
91949f98715ab667e28b3e2333df5a83eacbde20f8a12e21d83a9c931115f0e5
940f801632e189492d6ea9b6da03c2bd61fe4a7208c39397e87f1d783bbe78d3
98dd64e545863c785de22773cb7e78590488d376c309a348b5b142775ae32277
b10cb773ffe9487c981f670d7292f264b3c384b6a6e3f5b7196d9a6c287ec336
c46339ccb9fb376c9c9b59b03e7efb8f338a6f69c222fc07fae256ccf8d203e6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb4b21e75c9965646dff09688b762c94501e0250fe8e71b631b5f9acfcf8cccb
f6f888500b192e7c5e94c9029fdcc49f32ee2b3915ce760d12a81ada704fbd4c
fbfb5178ef1a29310093b5ee868197a78e357ddee9fd0bf92f766901e785da89

xeigjw.com Open in urlscan Pro 185.99.2.117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

59 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

133 kBTransfer

320 kBSize

0 Cookies

12 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

70 JavaScript Global Variables

0 Cookies

Indicators

xeigjw.com Open in urlscan Pro
185.99.2.117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

59 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

133 kB
Transfer

320 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!