qwrewre.dynvpn.de
Open in
urlscan Pro
27.100.36.206
Malicious Activity!
Public Scan
Submitted URL: https://rebrand.ly/072mjqe
Effective URL: https://qwrewre.dynvpn.de/cciittzx/cizenxz/home.html?kfvDLk4qKQlUPR90DXM9fajmKLwjIydUlGSvjLBOv7AFWhLq6zlIUXuKpIVj7lfYnphqo...
Submission: On June 03 via manual from US — Scanned from US
Effective URL: https://qwrewre.dynvpn.de/cciittzx/cizenxz/home.html?kfvDLk4qKQlUPR90DXM9fajmKLwjIydUlGSvjLBOv7AFWhLq6zlIUXuKpIVj7lfYnphqo...
Submission: On June 03 via manual from US — Scanned from US
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 31 HTTP transactions.
The main IP is 27.100.36.206, located in
Sydney, Australia and
belongs to HOSTUS-GLOBAL-AS HostUS, HK.
The main domain is qwrewre.dynvpn.de.
TLS certificate: Issued by R3 on June 2nd 2022. Valid for: 3 months.
This is the only time qwrewre.dynvpn.de was scanned on urlscan.io!
TLS certificate: Issued by R3 on June 2nd 2022. Valid for: 3 months.
This is the only time qwrewre.dynvpn.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citizens Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 184.72.167.253 184.72.167.253 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 1 32 | 27.100.36.206 27.100.36.206 | 7489 (HOSTUS-GL...) (HOSTUS-GLOBAL-AS HostUS) | |
| 31 | 1 |
1
184.72.167.253
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-184-72-167-253.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-184-72-167-253.compute-1.amazonaws.com
| rebrand.ly |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 32 |
dynvpn.de
1 redirects
qwrewre.dynvpn.de |
203 KB |
| 1 |
rebrand.ly
1 redirects
rebrand.ly — Cisco Umbrella Rank: 87847 |
302 B |
| 31 | 2 |
| Domain | Requested by | |
|---|---|---|
| 32 | qwrewre.dynvpn.de |
1 redirects
qwrewre.dynvpn.de
|
| 1 | rebrand.ly | 1 redirects |
| 31 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.citizensbank.com |
| jobs.citizensbank.com |
| www3.citizensbankonline.com |
| investor.citizensbank.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| qwrewre.dynvpn.de R3 |
2022-06-02 - 2022-08-31 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://qwrewre.dynvpn.de/cciittzx/cizenxz/home.html?kfvDLk4qKQlUPR90DXM9fajmKLwjIydUlGSvjLBOv7AFWhLq6zlIUXuKpIVj7lfYnphqo3ggdhgFZdZCXWmEardal0v0aCk7N4ApMPGzoPtZuAiCzvM7FcfybA3cWaS5aZo2Y
Frame ID: D43B43FAA5B2D7DB047C69A939CD93AA
Requests: 28 HTTP requests in this frame
Frame:
https://qwrewre.dynvpn.de/cciittzx/cizenxz/index_1.html
Frame ID: A879C1B3FBE7C267903BEB2794C1B70F
Requests: 1 HTTP requests in this frame
Frame:
https://qwrewre.dynvpn.de/cciittzx/cizenxz/index_2.html
Frame ID: 4C7A3FA8B1E4106201C9DCB3E20FD6C5
Requests: 1 HTTP requests in this frame
Frame:
https://qwrewre.dynvpn.de/cciittzx/cizenxz/index_3.html
Frame ID: CE64A9EACC47B8D39B76C0115D0B5E03
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Online Login | CitizensPage URL History Show full URLs
-
https://rebrand.ly/072mjqe
HTTP 301
https://qwrewre.dynvpn.de/cciittzx/cizenxz HTTP 301
https://qwrewre.dynvpn.de/cciittzx/cizenxz/ Page URL
- https://qwrewre.dynvpn.de/cciittzx/cizenxz/home.html?kfvDLk4qKQlUPR90DXM9fajmKLwjIydUlGSvjLBOv7AFWhLq6... Page URL
Page Statistics
51 Outgoing links
These are links going to different origins than the main page.
URL: http://www.citizensbank.com/
Search URL Search Domain Scan URL
URL: https://jobs.citizensbank.com/?utm_source=OT&utm_medium=Consumer_Marketing&utm_campaign=RM_CustomerMkt_OLB&utm_term=&utm_content=Other
Title: Learn more
Title: Learn more
Search URL Search Domain Scan URL
URL: https://www3.citizensbankonline.com/efs/ui/tli/index.html
Title: Trouble logging in?
Title: Trouble logging in?
Search URL Search Domain Scan URL
URL: https://www3.citizensbankonline.com/efs/servlet/efs/login-faqs.jsp
Title: View All Help Topics
Title: View All Help Topics
Search URL Search Domain Scan URL
URL: https://www3.citizensbankonline.com/efs/ui/enrollment/index.html
Title: Enroll Now
Title: Enroll Now
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking/
Title: Checking
Title: Checking
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/savings-and-cds/savings.aspx
Title: Savings
Title: Savings
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/savings-and-cds/money-markets.aspx
Title: Money Markets
Title: Money Markets
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/savings-and-cds/cds.aspx
Title: Certificates of Deposit (CDs) ®
Title: Certificates of Deposit (CDs) ®
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/ira/
Title: IRAs
Title: IRAs
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking-and-savings/programs-and-services.aspx
Title: Programs & Services
Title: Programs & Services
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking-and-savings/benefits-and-features.aspx
Title: Benefits & Features
Title: Benefits & Features
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking/debit-cards/standard.aspx
Title: Debit Card
Title: Debit Card
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/overdraft-protection/
Title: Overdraft Choices ®
Title: Overdraft Choices ®
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/mortgages/
Title: Mortgages
Title: Mortgages
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/home-equity/loans.aspx
Title: Home Equity Loans
Title: Home Equity Loans
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/home-equity/lines.aspx
Title: Home Equity Lines of Credit
Title: Home Equity Lines of Credit
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/loans/determine-my-rate.aspx
Title: Determine My Rate
Title: Determine My Rate
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-loans/default.aspx
Title: Student Loan Options
Title: Student Loan Options
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-loans/education-refinance-loan-overview.aspx
Title: Refinancing Student Loans
Title: Refinancing Student Loans
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-loans/process/default.aspx
Title: The Student Loan Process
Title: The Student Loan Process
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-loans/process/undergraduate.aspx
Title: Undergraduate Students & Parents
Title: Undergraduate Students & Parents
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-loans/process/graduate.aspx
Title: Graduate Students
Title: Graduate Students
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-loans/tools.aspx
Title: Tools & Information
Title: Tools & Information
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking/one-deposit-checking-account.aspx
Title: Banking for Students
Title: Banking for Students
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/student-services/access-my-student-loan/default.aspx
Title: Access My Student Loan
Title: Access My Student Loan
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/credit-cards/overview.aspx
Title: Credit Cards
Title: Credit Cards
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/cards-and-rewards/credit-cards/creditcardagreements/agreements.aspx
Title: Card Agreements
Title: Card Agreements
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/security/
Title: Security Features
Title: Security Features
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/personal-loans/overview.aspx
Title: Overview
Title: Overview
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/personal-loans/faqs.aspx
Title: FAQs
Title: FAQs
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking/order-checks.aspx
Title: Order Checks
Title: Order Checks
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/online-and-mobile-banking/default.aspx
Title: Online & Mobile Banking
Title: Online & Mobile Banking
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/customer-service/
Title: Customer Service
Title: Customer Service
Search URL Search Domain Scan URL
URL: http://investor.citizensbank.com/about-us/our-company.aspx
Title: About Citizens
Title: About Citizens
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/community/
Title: In the Community
Title: In the Community
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/careers/
Title: Careers
Title: Careers
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/about_our_ads.aspx
Title: About Our Ads
Title: About Our Ads
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/investing/
Title: Investing
Title: Investing
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/small-business/
Title: Small Business
Title: Small Business
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/commercial-banking/
Title: Commercial
Title: Commercial
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/pf/onlinebanking/terms.aspx
Title: Online Terms and Conditions
Title: Online Terms and Conditions
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/assets/pdf/E-SignDisclosure.pdf
Title: E-Sign Disclosure
Title: E-Sign Disclosure
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/checking-and-savings/account-documents.aspx
Title: Account Documents
Title: Account Documents
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/tools/leaving.aspx?url=http://www.fdic.gov
Title: Member FDIC
Title: Member FDIC
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/security/equal-housing-lender.aspx
Title: Equal Housing Lender
Title: Equal Housing Lender
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/tools/SiteMap.aspx
Title: Site Map
Title: Site Map
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/tools/leaving.aspx?url=http://www.facebook.com/citizensbank
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/tools/leaving.aspx?url=http://twitter.com/citizensbank
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/tools/leaving.aspx?url=http://linkedin.com/company/citizens-bank
Search URL Search Domain Scan URL
URL: http://www.citizensbank.com/tools/leaving.aspx?url=http://youtube.com/citizensbank
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rebrand.ly/072mjqe
HTTP 301
https://qwrewre.dynvpn.de/cciittzx/cizenxz HTTP 301
https://qwrewre.dynvpn.de/cciittzx/cizenxz/ Page URL
- https://qwrewre.dynvpn.de/cciittzx/cizenxz/home.html?kfvDLk4qKQlUPR90DXM9fajmKLwjIydUlGSvjLBOv7AFWhLq6zlIUXuKpIVj7lfYnphqo3ggdhgFZdZCXWmEardal0v0aCk7N4ApMPGzoPtZuAiCzvM7FcfybA3cWaS5aZo2Y Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://rebrand.ly/072mjqe HTTP 301
- https://qwrewre.dynvpn.de/cciittzx/cizenxz HTTP 301
- https://qwrewre.dynvpn.de/cciittzx/cizenxz/
31 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
qwrewre.dynvpn.de/cciittzx/cizenxz/ Redirect Chain
|
336 B 562 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
home.html
qwrewre.dynvpn.de/cciittzx/cizenxz/ |
33 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui-1.10.3.custom.min.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
normalize.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
59 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flows.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ad-containers.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citizensns.min.46109.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CTZ_Green-01.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
feedback.png.html
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
203 B 203 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
equal-housing.gif
qwrewre.dynvpn.de/cciittzx/cizenxz/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-follow-facebook.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
395 B 700 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-follow-twitter.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-follow-linkedin.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-follow-youtube.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
elh.gif
qwrewre.dynvpn.de/cciittzx/cizenxz/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fdicFooter.gif
qwrewre.dynvpn.de/cciittzx/cizenxz/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sec-3-6.css
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
2 KB 976 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index_1.html
qwrewre.dynvpn.de/cciittzx/cizenxz/ Frame A879 |
1 KB 1012 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon-secure.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
292 B 597 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flows-tooltip.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
364 B 669 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citizen_roman.woff
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
31 KB 32 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citiolb_icons.woff
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
18 KB 18 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow-button-white.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
1017 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow-down-blue.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow-right-orange.png
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
165 B 469 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citizen_book.woff
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
31 KB 31 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citizen_extrabold.woff
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
27 KB 28 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index_2.html
qwrewre.dynvpn.de/cciittzx/cizenxz/ Frame 4C7A |
1 KB 1012 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index_3.html
qwrewre.dynvpn.de/cciittzx/cizenxz/ Frame CE64 |
1 KB 1012 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
citizen_bold.woff
qwrewre.dynvpn.de/cciittzx/cizenxz/gift/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citizens Bank (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
qwrewre.dynvpn.de
rebrand.ly
184.72.167.253
27.100.36.206
0e9485cdb6a684713287cb41c6e6c3e26d12280f17349f98402456ff86ec9759
1de736c9599d01e531be8d0d6ebe181c421618861923fb48a54a836303108a10
25a7a102a22ad70761585350775304dd658ec1b2d79cfcba77d17ae70010a7c3
2a0a7ee3ea564db1e157dd2202c20b8092228fea9091f5cd1e83551e170ec277
445bd2c0e224b353f575e1c09ed13484d0badc779f040ccf262612a7c4d31ca0
4965f0299bc39056fe65b3d22aa0083ba74d1599074ae0b5a11d7f88d102504e
56a8532b2a60ca2ae39c213f7e1e65e47834af927e6365444457f22ed12ed79c
5975e7bc0bac01f0d855b46f3b8ea013c9cecd2821da394f66c0dfcb244a36f2
5bb2d438470a02799577010a14310fa8ac3ed7ea77ca15435aaaa154e407b3e6
6c1d1d9bfd164d59f79ccbb5170e261974466240b8fb643318c775a2242289fc
91afb84bded857517d6a7e43932e3d4a43eaf42d1e4d0b77a8bc9c07973e21d2
9af5181113e5d0eacfc3d9c0b3ad627dc3ad50708755fbe45ab18e0cad4f3b36
9b4ffac9ea755d2aaff724fa471d90fd63ae5648e18f60a67db0a5c3bffd84e5
b23d0629822256b320de68cece2a79525216c20a0b040d4ee0ee6dd216b98115
bbb90a8f240e6dbbda1d3da534f8848f256e623ed470d045e1d86a465e424d69
bf99a3203217c802888087df8a2c84b92e087829e7e24d38581a57cee763923b
c8b1f6c22756521c86a5b0053b8565b49436f7fa19d1bb7cdf00a7808df28d42
c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46
cad0f4b1f9bfa3f4ef94d78c20ae16464bda0fb3902fd7689e26a2904cea29d9
dfc042f7ff75f3c2f916bcfbff48c82834bab07b698a2c564906ca073f8286b2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb175662762ef5f2c9011cc1c4f9d09361c50a366fad8a544bda1c439b99d3a0
f98e6ebda173fd33e1edd2e1bcf8522b209a486eeb01c75bdaa72f684fd92954
fe3ddc37707c93f338a1f6359dfa03019e096df14454808aaccbb7538aa3c67b
ff327ec2a6dbd3fc76ceecf59e472d5d2f43c94dce851ced740abe5f75bb832e