![](/screenshots/775a14a7-5521-4a91-82a0-2fdaea658cf5.png)
www.capitalon.transmarine.com.pk
Open in
urlscan Pro
72.18.132.9
Malicious Activity!
Public Scan
Effective URL: http://www.capitalon.transmarine.com.pk/xntezodi=/login.php?cmd=Unlock&Token=44ecefe0bc80ebf78cf6e692807dec4a&session=5246_sssf2
Submission: On September 30 via api from US — Scanned from DE
Summary
This is the only time www.capitalon.transmarine.com.pk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citizens Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 10 | 72.18.132.9 72.18.132.9 | 30475 (WEHOSTWEB...) (WEHOSTWEBSITES-COM) | |
1 | 142.250.184.193 142.250.184.193 | 15169 (GOOGLE) (GOOGLE) | |
9 | 2 |
ASN30475 (WEHOSTWEBSITES-COM, US)
PTR: server90.a2zcreatorz.com
www.capitalon.transmarine.com.pk |
ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f1.1e100.net
my-style-css.blogspot.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
transmarine.com.pk
2 redirects
www.capitalon.transmarine.com.pk |
365 KB |
1 |
blogspot.com
my-style-css.blogspot.com |
|
9 | 2 |
Domain | Requested by | |
---|---|---|
10 | www.capitalon.transmarine.com.pk |
2 redirects
www.capitalon.transmarine.com.pk
|
1 | my-style-css.blogspot.com |
www.capitalon.transmarine.com.pk
|
9 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
misc-sni.blogspot.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.capitalon.transmarine.com.pk/xntezodi=/login.php?cmd=Unlock&Token=44ecefe0bc80ebf78cf6e692807dec4a&session=5246_sssf2
Frame ID: 2988D3A811796E7E2FAAEA038BB7DE63
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/775a14a7-5521-4a91-82a0-2fdaea658cf5.png)
Page Title
Citizens Banks - loginPage URL History Show full URLs
-
http://www.capitalon.transmarine.com.pk/
HTTP 302
http://www.capitalon.transmarine.com.pk/xntezodi=/index.php?cmd=_update_account&session=ODc2MDY2MjM2NDI4Nzg3MA== HTTP 302
http://www.capitalon.transmarine.com.pk/xntezodi=/login.php?cmd=Unlock&Token=44ecefe0bc80ebf78cf6e692807dec4a&sessio... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.capitalon.transmarine.com.pk/
HTTP 302
http://www.capitalon.transmarine.com.pk/xntezodi=/index.php?cmd=_update_account&session=ODc2MDY2MjM2NDI4Nzg3MA== HTTP 302
http://www.capitalon.transmarine.com.pk/xntezodi=/login.php?cmd=Unlock&Token=44ecefe0bc80ebf78cf6e692807dec4a&session=5246_sssf2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
![]() www.capitalon.transmarine.com.pk/xntezodi=/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
my-style-css.blogspot.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
q.js
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
286 KB 286 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
v.js
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
49 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m.js
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
18 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CTZ_Green-01.png
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock.png
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
292 B 533 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
call.png
www.capitalon.transmarine.com.pk/xntezodi=/res/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citizens Bank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.capitalon.transmarine.com.pk/ | Name: PHPSESSID Value: 04add72417a83a79d8f2b4af741dd99b |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
my-style-css.blogspot.com
www.capitalon.transmarine.com.pk
142.250.184.193
72.18.132.9
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
939ce6c74965d5556761a914165a986772d9fe35c8b56993ceb560b75158615d
a98ba7932567d77e66ee8ca6570de4e559f8e2cfcfd78d2917593272af7e72a4
bf99a3203217c802888087df8a2c84b92e087829e7e24d38581a57cee763923b
c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46
ca1415a994b05655d3a8fb4bbae4e38cfe62cfb17ecc559d1915f60bf39deb92
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3