erstebaning-logs-hu.bond
Open in
urlscan Pro
2a06:98c1:3121::3
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On October 31 via api from FI — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on October 20th 2022. Valid for: 3 months.
This is the only time erstebaning-logs-hu.bond was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Erste Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
11 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
erstebaning-logs-hu.bond
erstebaning-logs-hu.bond |
617 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 665 |
30 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 208 |
5 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
9 | erstebaning-logs-hu.bond |
erstebaning-logs-hu.bond
|
1 | code.jquery.com |
erstebaning-logs-hu.bond
|
1 | cdnjs.cloudflare.com |
erstebaning-logs-hu.bond
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.erstebaning-logs-hu.bond GTS CA 1P5 |
2022-10-20 - 2023-01-18 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://erstebaning-logs-hu.bond/
Frame ID: 6109DCB350A2204FEAE22F240E45742B
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
GeorgeDetected technologies
Axios (JavaScript libraries) ExpandDetected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
erstebaning-logs-hu.bond/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
erstebaning-logs-hu.bond/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.19.2/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flag-hu.png
erstebaning-logs-hu.bond/images/ |
177 B 532 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
george-animation.png
erstebaning-logs-hu.bond/images/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-logo.png
erstebaning-logs-hu.bond/images/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
erstebaning-logs-hu.bond/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader.js
erstebaning-logs-hu.bond/js/ |
488 B 570 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
206 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Inter-roman.var.woff2
erstebaning-logs-hu.bond/fonts/ |
221 KB 222 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
background-animation.jpg
erstebaning-logs-hu.bond/images/ |
344 KB 345 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Erste Bank (Banking)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| s string| m function| axios function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
code.jquery.com
erstebaning-logs-hu.bond
2001:4de0:ac18::1:a:3b
2606:4700::6811:190e
2a06:98c1:3121::3
12fb008a7409fc894a2acb115fa136875d51c3680a35fba70a2699d79a4bce51
16c9f006767b9b0ba55ac46d03ae43012bb1c2700f1b3f1c37760f12476b973a
2e5d7aa86d39af73f6e081f366ad9ed221435b7c1703b29d8e0731f5ba4090f9
44e3812723c88dbb52c9f7e39dd9c9eb318d4e286b19bf29a3f981364dfd0367
4b8697eb07dd220b2ee9ee52c37267db8b5af22323ac601604a03cc0bb3b608d
4ff7fb4a3bb565f34d7c187bb245a7d22765081708dd1c1d2d24b8fc8ecd40a4
5e69f28fccb728fdce3c2a06e427b7e53840f445142748f42a9a313061f206d7
6e6a10eed375b7e751dc9ce8682d06217d75726dea0041781126396fa44d98d5
a0c1d664a653555f4fd9245ef9be92cabb7f355186c29a4c1fe34e5c5956d2a9
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
ee3b95c3ef10f26a15c3d3010c502f172c7668e8c0a9f3e6f155e16d4b7257a5
fd8dac9788c6964dc94c0af2307a90d7f36a9c7aea6e6cebd99865e96f82bebe