scotiabanksls.com.cp-50.webhostbox.net Open in urlscan Pro
207.174.212.180 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://scotiabanksls.com.cp-50.webhostbox.net/
Submission: On September 24 via manual (September 24th 2018, 5:06:10 pm UTC) from US

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 207.174.212.180, located in United States and belongs to PUBLIC-DOMAIN-REGISTRY - PDR, US. The main domain is scotiabanksls.com.cp-50.webhostbox.net.

This is the only time scotiabanksls.com.cp-50.webhostbox.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Scotiabank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
3	207.174.212.180 207.174.212.180		394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY - PDR)
3	2

3 207.174.212.180 (United States)

ASN394695 (PUBLIC-DOMAIN-REGISTRY - PDR, US)
PTR: cp-50.webhostbox.net

scotiabanksls.com.cp-50.webhostbox.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	webhostbox.net scotiabanksls.com.cp-50.webhostbox.net	131 KB
3	1

	Domain	Requested by
3	scotiabanksls.com.cp-50.webhostbox.net	scotiabanksls.com.cp-50.webhostbox.net
3	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://scotiabanksls.com.cp-50.webhostbox.net/
Frame ID: CD4E5EE82537F861FE304DCC9A738B6B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ruby (Programming Languages) Expand

Overall confidence: 50%
Detected patterns

headers server /(?:mod_rails|mod_rack|Phusion(?:\.|_)Passenger)/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 50%
Detected patterns

headers server /(?:mod_rails|mod_rack|Phusion(?:\.|_)Passenger)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

131 kB
Transfer

179 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response scotiabanksls.com.cp-50.webhostbox.net/	84 KB 84 KB	476ms 339ms	Document text/html	207.174.212.180 PDR
General Check archive.org Show headers Download Go to Full URL http://scotiabanksls.com.cp-50.webhostbox.net/ Protocol HTTP/1.1 Server 207.174.212.180 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY - PDR, US), Reverse DNS cp-50.webhostbox.net Software Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4 Phusion_Passenger/5.1.12 / PHP/5.4.45 Resource Hash `4025c69466deee91a4678fbe159ea51f2d46107a7afd5184ea91882ed1cf28e8` Request headers Host scotiabanksls.com.cp-50.webhostbox.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 24 Sep 2018 17:06:00 GMT Server Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4 Phusion_Passenger/5.1.12 X-Powered-By PHP/5.4.45 Upgrade h2,h2c Connection Upgrade Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	counter.php scotiabanksls.com.cp-50.webhostbox.net/counter/	0 254 B	303ms 151ms	Image text/html	207.174.212.180 PDR
General Check archive.org Show headers Download Go to Show image Full URL http://scotiabanksls.com.cp-50.webhostbox.net/counter/counter.php Requested by Host: scotiabanksls.com.cp-50.webhostbox.net URL: http://scotiabanksls.com.cp-50.webhostbox.net/ Protocol HTTP/1.1 Server 207.174.212.180 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY - PDR, US), Reverse DNS cp-50.webhostbox.net Software Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4 Phusion_Passenger/5.1.12 / PHP/5.4.45 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scotiabanksls.com.cp-50.webhostbox.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://scotiabanksls.com.cp-50.webhostbox.net/ Connection keep-alive Cache-Control no-cache Referer http://scotiabanksls.com.cp-50.webhostbox.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Upgrade h2,h2c Date Mon, 24 Sep 2018 17:06:00 GMT Server Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4 Phusion_Passenger/5.1.12 Connection Upgrade X-Powered-By PHP/5.4.45 Content-Length 0 Content-Type text/html
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6620ed8324470d29f8acccd40457c96bf041d87d69a6b23457ee52342427c74d` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET DATA	200 OK	truncated /	2 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c9c0bf055b15a4b09d7fdee29511878fa10f1790f7297466ebc78227d50957f6` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1dc148caf3ae416b653bfdcd9847da3642546e9683e164e2e0dc5c0aad6af87f` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	17 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7e11524dc33e167b4124f11ae800c36edeb35369b078f285f7003f79c222b707` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/jpeg
GET H/1.1	200 OK	code.js Show response scotiabanksls.com.cp-50.webhostbox.net/	46 KB 46 KB	141ms 141ms	Script application/javascript	207.174.212.180 PDR
General Check archive.org Show headers Download Go to Full URL http://scotiabanksls.com.cp-50.webhostbox.net/code.js Requested by Host: scotiabanksls.com.cp-50.webhostbox.net URL: http://scotiabanksls.com.cp-50.webhostbox.net/ Protocol HTTP/1.1 Server 207.174.212.180 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY - PDR, US), Reverse DNS cp-50.webhostbox.net Software Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4 Phusion_Passenger/5.1.12 / Resource Hash `2948074facf48cc8d9b7f240d28693a6e6f4c32ce859eef2abd51b777c348d81` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scotiabanksls.com.cp-50.webhostbox.net User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://scotiabanksls.com.cp-50.webhostbox.net/ Connection keep-alive Cache-Control no-cache Referer http://scotiabanksls.com.cp-50.webhostbox.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 24 Sep 2018 17:06:01 GMT Last-Modified Thu, 02 Aug 2018 16:12:30 GMT Server Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4 Phusion_Passenger/5.1.12 ETag "6080097-b87f-5727613f3b780" Upgrade h2,h2c Connection Upgrade Accept-Ranges bytes Content-Type application/javascript Content-Length 47231
GET DATA	200 OK	truncated /	24 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b6e51acd432dec5bd1e77be15d596e3b5c61e7fd9e5768d93effaf597e81b1c2` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Tables object| store object| _tables string| x

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

scotiabanksls.com.cp-50.webhostbox.net
207.174.212.180
1dc148caf3ae416b653bfdcd9847da3642546e9683e164e2e0dc5c0aad6af87f
2948074facf48cc8d9b7f240d28693a6e6f4c32ce859eef2abd51b777c348d81
4025c69466deee91a4678fbe159ea51f2d46107a7afd5184ea91882ed1cf28e8
6620ed8324470d29f8acccd40457c96bf041d87d69a6b23457ee52342427c74d
7e11524dc33e167b4124f11ae800c36edeb35369b078f285f7003f79c222b707
b6e51acd432dec5bd1e77be15d596e3b5c61e7fd9e5768d93effaf597e81b1c2
c9c0bf055b15a4b09d7fdee29511878fa10f1790f7297466ebc78227d50957f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

scotiabanksls.com.cp-50.webhostbox.net Open in urlscan Pro 207.174.212.180 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

131 kBTransfer

179 kBSize

0 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

scotiabanksls.com.cp-50.webhostbox.net Open in urlscan Pro
207.174.212.180 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

131 kB
Transfer

179 kB
Size

0
Cookies

3 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!