maxxforex.com
Open in
urlscan Pro
162.241.216.110
Malicious Activity!
Public Scan
Effective URL: https://maxxforex.com/natwest/Login.php?sslchannel=true&sessionid=CZ4m8qi7O0siHBXKkPDszQZg0yVssOc5NhrWHK4vKwOr8LcsBPVa...
Submission: On July 11 via manual from GB
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on June 14th 2019. Valid for: 3 months.
This is the only time maxxforex.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 23.95.4.194 23.95.4.194 | 36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing) | |
16 | 162.241.216.110 162.241.216.110 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
17 | 2 |
ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: orange.availabledns.com
live.fobyz.com |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box5398.bluehost.com
maxxforex.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
maxxforex.com
maxxforex.com |
145 KB |
1 |
fobyz.com
live.fobyz.com |
307 B |
17 | 2 |
Domain | Requested by | |
---|---|---|
16 | maxxforex.com |
live.fobyz.com
maxxforex.com |
1 | live.fobyz.com | |
17 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
maxxforex.com Let's Encrypt Authority X3 |
2019-06-14 - 2019-09-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://maxxforex.com/natwest/Login.php?sslchannel=true&sessionid=CZ4m8qi7O0siHBXKkPDszQZg0yVssOc5NhrWHK4vKwOr8LcsBPVaGUqHsmaVam1YEtUldYQYvEqDqC51
Frame ID: 9E1BB4BF0794D523FD50810885797A14
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://live.fobyz.com/rfq/ Page URL
- https://maxxforex.com/natwest/ Page URL
- https://maxxforex.com/natwest/Login.php?sslchannel=true&sessionid=CZ4m8qi7O0siHBXKkPDszQZg0yVssOc5... Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://live.fobyz.com/rfq/ Page URL
- https://maxxforex.com/natwest/ Page URL
- https://maxxforex.com/natwest/Login.php?sslchannel=true&sessionid=CZ4m8qi7O0siHBXKkPDszQZg0yVssOc5NhrWHK4vKwOr8LcsBPVaGUqHsmaVam1YEtUldYQYvEqDqC51 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
live.fobyz.com/rfq/ |
92 B 307 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
maxxforex.com/natwest/ |
204 B 396 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
maxxforex.com/natwest/ |
26 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
enc.js
maxxforex.com/natwest/assets/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
maxxforex.com/natwest/assets/css/ |
69 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
color.css
maxxforex.com/natwest/assets/css/ |
28 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
maxxforex.com/natwest/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bank.gif
maxxforex.com/natwest/assets/img/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc.gif
maxxforex.com/natwest/assets/img/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error.gif
maxxforex.com/natwest/assets/img/ |
111 B 140 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
security.gif
maxxforex.com/natwest/assets/img/ |
37 KB 37 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
reg.woff
maxxforex.com/natwest/assets/fonts/ |
22 KB 22 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white-lock.png
maxxforex.com/natwest/assets/img/ |
285 B 315 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
topLine.gif
maxxforex.com/natwest/assets/img/ |
915 B 945 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arr.gif
maxxforex.com/natwest/assets/img/ |
53 B 82 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-bg.png
maxxforex.com/natwest/assets/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bol.woff
maxxforex.com/natwest/assets/fonts/ |
23 KB 23 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt function| Check1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
maxxforex.com/ | Name: PHPSESSID Value: 4rqsrffor75pleonau98uhr873 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
live.fobyz.com
maxxforex.com
162.241.216.110
23.95.4.194
0fce4795c07caeffdb196345e3b48ed717d6c77af2d89efefc31db8d8f11b695
12da6746d1f2394818ae4a4e60643e6d12a8e1700cba35e7b357b6eac10c656e
23d5df83d5a429e895043a5ce3b11b682e3d0b182d1032b89b0596de272f1a7e
34a696b824cb72b7bcbba9eca5d95f67292b7489c3ccd4b9c19dfd36c63c6793
48827d7cb1ec7b7d7eacf3d9a8285aa25a006511a29da0223da8b919b903042b
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
682df64974058b47f875e3e8c904ad1b28325a9b37e30b0735b7bd057b61be9a
6d1e9e578e9454782bdb9bb7fbb90f271b1c0e65057fcfaf45f38eb5dca07af3
7528091702ad7a5db84629e92aa6bce8b8936981e7271878f3f8f91dbe172242
7f11d3d161674721f0a96c235040d618461015c1193de9d65b621ee773fa98f8
7f3671cc7fb5e83ceb3c48355aa4756038f75aa4d5a34ddbe7abfc5d1cc2dce4
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
d682a0303d4723b38fcce4535aa1d8759a067c2de4393925e404afa310109acb
dbc1cad17ed91a5684d115f609df37622969737bc3a0db64c7e8b8c20b994e30
e4a1b9628a61642629299077aa8074e3ee6b280d397efa0d7220c7b09efe8522
faec2bd1524ea1127fb1a6fa6f9cc3af135442f296c125851d9d2398c7d1368a