www.update-bankoamerica.com Open in urlscan Pro
31.170.161.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.update-bankoamerica.com/
Submission: On August 12 via automatic, source certstream-suspicious (August 12th 2020, 10:55:24 pm UTC)

Summary HTTP 25 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 25 HTTP transactions. The main IP is 31.170.161.16, located in United States and belongs to AS-HOSTINGER, LT. The main domain is www.update-bankoamerica.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 12th 2020. Valid for: 3 months.

This is the only time www.update-bankoamerica.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	31.170.161.16 31.170.161.16	47583 (AS-HOSTINGER) (AS-HOSTINGER)
2	130.61.96.156 130.61.96.156	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
7	34.252.100.36 34.252.100.36	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:20:... 2606:4700:20::681a:cc8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	5

10 31.170.161.16 (United States)

ASN47583 (AS-HOSTINGER, LT)

www.update-bankoamerica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 130.61.96.156 (Frankfurt am Main, Germany)

ASN31898 (ORACLE-BMC-31898, US)

cdn.smartclip-services.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.252.100.36 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-100-36.eu-west-1.compute.amazonaws.com

des.smartclip.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:cc8 (United States)

ASN13335 (CLOUDFLARENET, US)

hosting.miarroba.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	update-bankoamerica.com www.update-bankoamerica.com	226 KB
7	smartclip.net des.smartclip.net	12 KB
2	miarroba.info hosting.miarroba.info	979 B
2	smartclip-services.com cdn.smartclip-services.com	22 KB
0	bankofamerica.com Failed www.bankofamerica.com Failed
25	5

	Domain	Requested by
10	www.update-bankoamerica.com	www.update-bankoamerica.com
7	des.smartclip.net	www.update-bankoamerica.com
2	hosting.miarroba.info	www.update-bankoamerica.com
2	cdn.smartclip-services.com	www.update-bankoamerica.com
0	www.bankofamerica.com Failed	www.update-bankoamerica.com
25	5

This site contains no links.

Subject Issuer	Validity	Valid
update-bankoamerica.com Let's Encrypt Authority X3	`2020-08-12` - `2020-11-10`	3 months	crt.sh
*.smartclip-services.com Sectigo RSA Domain Validation Secure Server CA	`2019-12-30` - `2021-12-29`	2 years	crt.sh
*.smartclip.net Amazon	`2020-02-29` - `2021-03-29`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-16` - `2021-07-16`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.update-bankoamerica.com/
Frame ID: 71E7B7DA0958D283D42075CE9FCB40CD
Requests: 24 HTTP requests in this frame

Frame: https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php
Frame ID: 82D22383E725B912EF81A17A14C0DD83
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

25
Requests

84 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

261 kB
Transfer

877 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.update-bankoamerica.com/	34 KB 10 KB	536ms 164ms	Document text/html	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / PHP/7.2.32 Resource Hash `5b6c387f199d2f2568a8f3d8a506f9f12970e9847e32ce682e47a45ab8a8c1b8` Request headers :method GET :authority www.update-bankoamerica.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 x-powered-by PHP/7.2.32 content-type text/html; charset=UTF-8 cache-control public, max-age=604800 expires Wed, 19 Aug 2020 22:54:51 GMT content-length 10015 content-encoding br vary Accept-Encoding date Wed, 12 Aug 2020 22:54:51 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	gtm5445.html Show response www.update-bankoamerica.com/www.googletagmanager.com/	34 KB 10 KB	402ms 401ms	Script text/html	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/www.googletagmanager.com/gtm5445.html?id=GTM-T2VG59 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / PHP/7.2.32 Resource Hash `5b6c387f199d2f2568a8f3d8a506f9f12970e9847e32ce682e47a45ab8a8c1b8` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:51 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.2.32 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 cache-control public, max-age=604800 content-length 10015 expires Wed, 19 Aug 2020 22:54:51 GMT
GET H2	200	f.txt Show response www.update-bankoamerica.com/pagead2.googlesyndication.com/pagead/js/	34 KB 10 KB	409ms 407ms	Script text/html	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/pagead2.googlesyndication.com/pagead/js/f.txt Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / PHP/7.2.32 Resource Hash `5b6c387f199d2f2568a8f3d8a506f9f12970e9847e32ce682e47a45ab8a8c1b8` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:51 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.2.32 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 cache-control public, max-age=604800 content-length 10015 expires Wed, 19 Aug 2020 22:54:51 GMT
GET H2	200	vipaa-v4-jawr.css www.update-bankoamerica.com/source/	448 KB 61 KB	161ms 160ms	Stylesheet text/css	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/source/vipaa-v4-jawr.css Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / Resource Hash `5348dc1a48ac3b8d64743434443324f4cd4ef8324f52db2e4ef874e001af1da8` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:51 GMT content-encoding br last-modified Wed, 12 Aug 2020 22:52:11 GMT server LiteSpeed etag "70006-5f34729b-d16659852ac869ad;br" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=2592000 accept-ranges bytes content-length 62328 expires Fri, 11 Sep 2020 22:54:51 GMT
GET H2	200	jquery.min.js Show response www.update-bankoamerica.com/frostEdit/libs/jquery/3.4.1/	86 KB 29 KB	161ms 160ms	Script application/x-javascript	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/frostEdit/libs/jquery/3.4.1/jquery.min.js Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:51 GMT content-encoding br last-modified Wed, 12 Aug 2020 22:52:11 GMT server LiteSpeed etag "15851-5f34729b-49988b1837abfc85;br" vary Accept-Encoding content-type application/x-javascript status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 30047 expires Wed, 19 Aug 2020 22:54:51 GMT
GET H/1.1	200 OK	miarroba.js Show response cdn.smartclip-services.com/v1/Storage-a482323/smartclip-services/ava/config/	2 KB 2 KB	187ms 59ms	Script application/javascript	130.61.96.156 ORACLE-BMC-31898
General Check archive.org Show headers Download Go to Full URL https://cdn.smartclip-services.com/v1/Storage-a482323/smartclip-services/ava/config/miarroba.js Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 130.61.96.156 Frankfurt am Main, Germany, ASN31898 (ORACLE-BMC-31898, US), Reverse DNS Software / Resource Hash `297b2188e8b8a5bd95bc5fea0996c0ac64bb6b500e1ff23001d881ccccebf7a5` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:51 GMT Last-Modified Mon, 30 Mar 2020 14:17:15 GMT ETag "5e81ff6b-748" Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers Content-Length,Content-Range Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range Content-Length 1864 Expires Thu, 13 Aug 2020 22:54:51 GMT
GET H2	200	lz_loaderad05.js Show response www.update-bankoamerica.com/img.sunmediaads.com/ads/	34 KB 10 KB	188ms 183ms	Script text/html	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/img.sunmediaads.com/ads/lz_loaderad05.js?ver=1.4 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / PHP/7.2.32 Resource Hash `5b6c387f199d2f2568a8f3d8a506f9f12970e9847e32ce682e47a45ab8a8c1b8` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:52 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.2.32 vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 cache-control public, max-age=604800 content-length 10015 expires Wed, 19 Aug 2020 22:54:52 GMT
GET H2	200	BofA_rgb.png www.update-bankoamerica.com/Images/	38 KB 39 KB	164ms 159ms	Image image/png	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://www.update-bankoamerica.com/Images/BofA_rgb.png Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / Resource Hash `30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:52 GMT last-modified Wed, 12 Aug 2020 22:52:11 GMT server LiteSpeed etag "99fe-5f34729b-b04203d23f8f6072;;;" content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 39422 expires Thu, 12 Aug 2021 22:54:52 GMT
GET H2	200	mobile_llama.png www.update-bankoamerica.com/Images/	19 KB 19 KB	164ms 159ms	Image image/png	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://www.update-bankoamerica.com/Images/mobile_llama.png Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / Resource Hash `6bb1d4b1b719488b9812d1fb67b41b03857eec8f4e0a4d46a8066574037d817a` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:52 GMT last-modified Wed, 12 Aug 2020 22:52:11 GMT server LiteSpeed etag "4adf-5f34729b-3f56e882830c103e;;;" content-type image/png status 200 cache-control public, max-age=31536000 accept-ranges bytes content-length 19167 expires Thu, 12 Aug 2021 22:54:52 GMT
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	231ms 73ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=39521979 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `b2b2f802c31015858ee5fbf1e248cd59e16d7267bf070a08f0c33f2e4a7fdb05` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 5e39f4d9-3282-4da9-8d8d-6897a3f574ce Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	223ms 74ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=82532775 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `eabc6ab50d00fefc001538aaef8cf0076a42836d2c7283a7d5ee6cb062b83570` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 703ab959-f929-497e-84dc-b5497f32abcb Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
GET H/1.1	200 OK	ava.js Show response cdn.smartclip-services.com/v1/Storage-a482323/smartclip-services/ava/	76 KB 19 KB	91ms 86ms	Script application/javascript	130.61.96.156 ORACLE-BMC-31898
General Check archive.org Show headers Download Go to Full URL https://cdn.smartclip-services.com/v1/Storage-a482323/smartclip-services/ava/ava.js Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 130.61.96.156 Frankfurt am Main, Germany, ASN31898 (ORACLE-BMC-31898, US), Reverse DNS Software / Resource Hash `94a3f5c1801fd7529d4733e86f11ae5af5c665abddc3e12e5f01ee2178729bd3` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma public Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Last-Modified Wed, 29 Jul 2020 13:17:14 GMT ETag W/"5f2176da-12e6a" Transfer-Encoding chunked Content-Type application/javascript Cache-Control max-age=259200, public Connection keep-alive Expires Sat, 15 Aug 2020 22:54:52 GMT
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	225ms 73ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=93608661 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `0b5a4db2969bb082f04e519203c92b42130c2b201c12da01933793d61ff79c9d` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 4e33d20c-8b06-4475-8c90-6601c39ff4b4 Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	226ms 73ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=42754269 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `08aecdcb635193130bc8d5095666e8d3dd713517e95ddfe0dff270b95279d75f` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 7243ec2f-1bc9-4660-81bb-4a528380e58a Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	226ms 74ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=97695233 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `1383d44d2e78e1202dceea184b622484d15813f71010294563462f641d7aa473` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 5df8b1fe-812c-448d-8065-8aee7cc4d603 Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	227ms 74ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=76160770 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `17f11c5ee427ea7075d675050f9e87001371223addbd927ab8b74d8d986b3311` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 11262521-dca1-49f3-801e-4f7ba8136800 Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
GET H2	200	/ Show response hosting.miarroba.info/	1 KB 979 B	212ms 166ms	Script application/javascript	2606:4700:20::681a:cc8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hosting.miarroba.info/?__muid=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&h=1969761&t=1589472951&k=98231aabc225c56398d4caab3958b6a1 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:cc8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `221f564c1c8cd3055ede107ea6308b6d18b4d0e0ac82bd438dd542cb97ad2f32` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cf-ray 5c1dc7d71c651f25-FRA pragma no-cache date Wed, 12 Aug 2020 22:54:52 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 12 Aug 2020 22:54:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" status 200 cache-control no-cache content-type application/javascript; charset=iso-8859-1 cf-request-id 04867b3a7200001f25ea1a1200000001 expires Mon, 26 Jul 1997 05:00:00 GMT
GET H2	200	vipaa-v4-jawr-print.css www.update-bankoamerica.com/source/	10 KB 1 KB	164ms 160ms	Stylesheet text/css	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/source/vipaa-v4-jawr-print.css Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / Resource Hash `892981e91f766052cef3c087111050bf8396443882602cadd36b5963fdcd37be` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 12 Aug 2020 22:54:52 GMT content-encoding br last-modified Wed, 12 Aug 2020 22:52:11 GMT server LiteSpeed etag "271d-5f34729b-1dfaa62742b0b2e8;br" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=2592000 accept-ranges bytes content-length 1110 expires Fri, 11 Sep 2020 22:54:52 GMT
GET		fsd-secure-esp-sprite.png www.bankofamerica.com/pa/components/modules/header-module/2.8/graphic/	0 0

GET		error-large.gif www.bankofamerica.com/pa/components/modules-app/VIPAA/messaging-vipaa-module/1.0/graphic/	0 0

GET		gfootb-static-sprite.png www.bankofamerica.com/pa/components/modules/global-footer-module/2.5/graphic/	0 0

GET		gfoot-home-icon.png www.bankofamerica.com/pa/components/modules/global-footer-module/2.5/graphic/	0 0

GET H2	200	cnx-regular.woff www.update-bankoamerica.com/source/	37 KB 37 KB	174ms 173ms	Font application/font-woff	31.170.161.16 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.update-bankoamerica.com/source/cnx-regular.woff Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 31.170.161.16 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software LiteSpeed / Resource Hash `1c1b1ebfcdafd18df832e97201c689f62c2667791ce18a2c08a8fc3002884957` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.update-bankoamerica.com/ Origin https://www.update-bankoamerica.com Response headers date Wed, 12 Aug 2020 22:54:52 GMT last-modified Wed, 12 Aug 2020 22:52:11 GMT server LiteSpeed etag "954c-5f34729b-a5704b866c98eb6e;;;" content-type application/font-woff status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 38220 expires Wed, 19 Aug 2020 22:54:52 GMT
GET H/1.1	200	ads Show response des.smartclip.net/	3 KB 2 KB	75ms 74ms	Script application/javascript	34.252.100.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://des.smartclip.net/ads?type=dyn&plc=75133&elementId=44ea2e90b2cdfd7bc177e53c3e7e877db57d31de&sz=400x320&rnd=57042930 Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.100.36 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-100-36.eu-west-1.compute.amazonaws.com Software nginx/1.17.6 / Resource Hash `68e806b20f56939775c551e7d150e3147186d7e585b2a10e9d09c57689085853` Request headers Referer https://www.update-bankoamerica.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 12 Aug 2020 22:54:52 GMT Content-Encoding gzip Sc-Supply-Network 999999 Vary Accept-Encoding P3P CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Sc-Uuid 2e4287a1-d629-426b-81e6-c8eea0f2a2c4 Transfer-Encoding chunked Connection keep-alive Access-Control-Allow-Credentials true Content-Type application/javascript; charset=utf-8 Sc-Device-Type PC Server nginx/1.17.6
POST H2	200	607f6b0b381bbc1f64fa027d62891072_cookie.php hosting.miarroba.info/ Frame 82D2	0 0	155ms 153ms	Document text/html	2606:4700:20::681a:cc8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hosting.miarroba.info/607f6b0b381bbc1f64fa027d62891072_cookie.php Requested by Host: www.update-bankoamerica.com URL: https://www.update-bankoamerica.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:cc8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method POST :authority hosting.miarroba.info :scheme https :path /607f6b0b381bbc1f64fa027d62891072_cookie.php content-length 162 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 origin https://www.update-bankoamerica.com content-type application/x-www-form-urlencoded user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.update-bankoamerica.com/ accept-encoding gzip, deflate, br accept-language en-US cookie __weslvu=1597272892 Upgrade-Insecure-Requests 1 Origin https://www.update-bankoamerica.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.update-bankoamerica.com/ Response headers status 200 date Wed, 12 Aug 2020 22:54:52 GMT content-type text/html; charset=iso-8859-1 set-cookie __cfduid=d4d0e0c26ec55ba616f8f180a6c8fefd31597272892; expires=Fri, 11-Sep-20 22:54:52 GMT; path=/; domain=.miarroba.info; HttpOnly; SameSite=Lax __weslvu=1597272892; expires=Wed, 12-Aug-2020 23:54:52 GMT; Max-Age=3600; path=/; domain=hosting.miarroba.info vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 04867b3b3100001f25ea1ac200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5c1dc7d84ed71f25-FRA content-encoding br

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.bankofamerica.com
URL: https://www.bankofamerica.com/pa/components/modules/header-module/2.8/graphic/fsd-secure-esp-sprite.png

Domain: www.bankofamerica.com
URL: https://www.bankofamerica.com/pa/components/modules-app/VIPAA/messaging-vipaa-module/1.0/graphic/error-large.gif

Domain: www.bankofamerica.com
URL: https://www.bankofamerica.com/pa/components/modules/global-footer-module/2.5/graphic/gfootb-static-sprite.png

Domain: www.bankofamerica.com
URL: https://www.bankofamerica.com/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.hosting.miarroba.info/	1970-01-19 11:41:16	Name: __weslvu Value: 1597272892
			hosting.miarroba.info/	1970-01-19 11:41:16	Name: __weslvu Value: 1597272892

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.smartclip-services.com
des.smartclip.net
hosting.miarroba.info
www.bankofamerica.com
www.update-bankoamerica.com
www.bankofamerica.com
130.61.96.156
2606:4700:20::681a:cc8
31.170.161.16
34.252.100.36
08aecdcb635193130bc8d5095666e8d3dd713517e95ddfe0dff270b95279d75f
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0b5a4db2969bb082f04e519203c92b42130c2b201c12da01933793d61ff79c9d
1383d44d2e78e1202dceea184b622484d15813f71010294563462f641d7aa473
17f11c5ee427ea7075d675050f9e87001371223addbd927ab8b74d8d986b3311
1c1b1ebfcdafd18df832e97201c689f62c2667791ce18a2c08a8fc3002884957
221f564c1c8cd3055ede107ea6308b6d18b4d0e0ac82bd438dd542cb97ad2f32
297b2188e8b8a5bd95bc5fea0996c0ac64bb6b500e1ff23001d881ccccebf7a5
30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787
5348dc1a48ac3b8d64743434443324f4cd4ef8324f52db2e4ef874e001af1da8
5b6c387f199d2f2568a8f3d8a506f9f12970e9847e32ce682e47a45ab8a8c1b8
68e806b20f56939775c551e7d150e3147186d7e585b2a10e9d09c57689085853
6bb1d4b1b719488b9812d1fb67b41b03857eec8f4e0a4d46a8066574037d817a
892981e91f766052cef3c087111050bf8396443882602cadd36b5963fdcd37be
94a3f5c1801fd7529d4733e86f11ae5af5c665abddc3e12e5f01ee2178729bd3
b2b2f802c31015858ee5fbf1e248cd59e16d7267bf070a08f0c33f2e4a7fdb05
eabc6ab50d00fefc001538aaef8cf0076a42836d2c7283a7d5ee6cb062b83570

www.update-bankoamerica.com Open in urlscan Pro 31.170.161.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

25 Requests

84 %HTTPS

25 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

261 kBTransfer

877 kBSize

2 Cookies

0 Outgoing links

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

34 JavaScript Global Variables

2 Cookies

Indicators

www.update-bankoamerica.com Open in urlscan Pro
31.170.161.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

84 %
HTTPS

25 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

261 kB
Transfer

877 kB
Size

2
Cookies

25 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!