darantaylor.com
Open in
urlscan Pro
147.135.152.220
Malicious Activity!
Public Scan
URL:
https://darantaylor.com/FundsTransferConfirmation.html
Submission: On September 30 via automatic, source openphish — Scanned from DE
Submission: On September 30 via automatic, source openphish — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 13 HTTP transactions.
The main IP is 147.135.152.220, located in
France and
belongs to OVH, FR.
The main domain is darantaylor.com.
TLS certificate: Issued by R3 on September 25th 2021. Valid for: 3 months.
This is the only time darantaylor.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on September 25th 2021. Valid for: 3 months.
This is the only time darantaylor.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: RAKBANK (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 147.135.152.220 147.135.152.220 | 16276 (OVH) (OVH) | |
| 1 | 213.42.202.214 213.42.202.214 | 5384 (EMIRATES-...) (EMIRATES-INTERNET Emirates Internet) | |
| 13 | 3 |
1
213.42.202.214
(Dubai, United Arab Emirates)
ASN5384 (EMIRATES-INTERNET Emirates Internet, AE)
ASN5384 (EMIRATES-INTERNET Emirates Internet, AE)
| rakbank.ae |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
darantaylor.com
darantaylor.com |
22 KB |
| 1 |
rakbank.ae
rakbank.ae |
11 KB |
| 0 |
payfort.com
Failed
secure.payfort.com Failed |
|
| 13 | 3 |
| Domain | Requested by | |
|---|---|---|
| 11 | darantaylor.com |
darantaylor.com
|
| 1 | rakbank.ae |
darantaylor.com
|
| 0 | secure.payfort.com Failed |
darantaylor.com
|
| 13 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| secure.payfort.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| darantaylor.com R3 |
2021-09-25 - 2021-12-24 |
3 months | crt.sh |
| rakbank.ae DigiCert SHA2 Extended Validation Server CA |
2020-11-15 - 2021-12-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://darantaylor.com/FundsTransferConfirmation.html
Frame ID: 9AFBC0682A4AF05C4F93DAE172E98779
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Emirates NBD Security UpdateDetected technologies
RequireJS
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- require.*\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://secure.payfort.com/ncol/prod/card_verification_code.asp?lang=1&ABRAND=%3BEurocard%3BVISA&CSRFSP=%2Fncol%2Fprod%2Forderstandard%2Easp&CSRFKEY=89DBF010FB48F5AB3898CD1E1340CE8E557DF396&CSRFTS=20200629005806
Title: What is this?
Title: What is this?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
FundsTransferConfirmation.html
darantaylor.com/ |
22 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
rakbank.ae/wps/contenthandler/!ut/p/digest!3JKaotSk_gMd0aUfF0xN-w/war/rakbank/themes/RAKBankThemeStatic/themes/RAKBankTheme/conventional/img/ |
6 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.3.1.min.js
darantaylor.com/js/jquery.core/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-migrate-1.4.1.min.js
darantaylor.com/js/jquery.plugins/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Class.create.js
darantaylor.com/js/jquery.plugins/dependencies/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.jquery-encoder-0.1.0.min.js
darantaylor.com/js/jquery.plugins/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
required_fields.js
darantaylor.com/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
form_validation.js
darantaylor.com/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Fp_inc.1.2.js
darantaylor.com/js/fp/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
base64_inc.js
darantaylor.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
wait_turn.gif
secure.payfort.com/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Fp_inc.1.2.js
darantaylor.com/js/fp/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
base64_inc.js
darantaylor.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secure.payfort.com
- URL
- https://secure.payfort.com/images/wait_turn.gif
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: RAKBANK (Banking)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster undefined| ncolwaitwindow number| ncolwaitwindowopen function| ShowWaitMsg function| my_submitAndWait function| justWait function| close_ncol_wait function| trustHTML object| OGONE function| createHiddenInput number| js_version string| AlertMSG_109 string| AlertMSG_110 string| AlertMSG_173 string| AlertMSG_1205 string| AlertMSG_111 string| AlertERR_907 string| AlertERR_95 string| AlertERR_96 number| G_lsu function| my_valscript undefined| cvc_NbrFormFields string| arrcvc string| arrDispCVCFlag function| ClearForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
darantaylor.com
rakbank.ae
secure.payfort.com
secure.payfort.com
147.135.152.220
213.42.202.214
2a9d1767e7d067aae07e9607c7a87fededb9cd88844c82177afa0f41bc399146
72e49ecbfe2f576834af1e276b67517c9d49624895aad39c2ba2590352f53a16