royaldevice-authenticator.com
Open in
urlscan Pro
146.70.88.25
Malicious Activity!
Public Scan
Submitted URL: https://royaldevice-authenticator.com/
Effective URL: https://royaldevice-authenticator.com/deposit/rbc/jdmQcs3z3oIM7A8Q
Submission: On March 25 via api from US — Scanned from US
Effective URL: https://royaldevice-authenticator.com/deposit/rbc/jdmQcs3z3oIM7A8Q
Submission: On March 25 via api from US — Scanned from US
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 146.70.88.25, located in
Paris, France and
belongs to M247, RO.
The main domain is royaldevice-authenticator.com.
TLS certificate: Issued by R3 on March 24th 2024. Valid for: 3 months.
This is the only time royaldevice-authenticator.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on March 24th 2024. Valid for: 3 months.
This is the only time royaldevice-authenticator.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: RBC (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 7 | 146.70.88.25 146.70.88.25 | 9009 (M247) (M247) | |
| 1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
| 8 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
royaldevice-authenticator.com
1 redirects
royaldevice-authenticator.com |
686 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1217 |
30 KB |
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | royaldevice-authenticator.com |
1 redirects
royaldevice-authenticator.com
code.jquery.com |
| 1 | code.jquery.com |
royaldevice-authenticator.com
|
| 8 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| applinks.rbcroyalbank.com |
| itunes.apple.com |
| www.rbcroyalbank.com |
| www1.royalbank.com |
| www1.rbcbank.com |
| caribbean.rbcroyalbank.com |
| www6.rbc.com |
| www.rbcglobaltrade.rbc.com |
| www.rbc.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| royaldevice-authenticator.com R3 |
2024-03-24 - 2024-06-22 |
3 months | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://royaldevice-authenticator.com/deposit/rbc/jdmQcs3z3oIM7A8Q
Frame ID: D26704CDA685C8F87EC1A89DF45036C3
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
RBC Royal Bank – Secure Sign InPage URL History Show full URLs
-
https://royaldevice-authenticator.com/
HTTP 302
https://royaldevice-authenticator.com/deposit/rbc/jdmQcs3z3oIM7A8Q Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
URL: https://applinks.rbcroyalbank.com/RtYB
Title: INSTALL
Title: INSTALL
Search URL Search Domain Scan URL
URL: https://itunes.apple.com/ca/app/rbc-mobile/id407597290?mt=8
Title: View
Title: View
Search URL Search Domain Scan URL
URL: https://www.rbcroyalbank.com/onlinebanking/bankingusertips/notices/as-of-june2022-rbc-online-banking-will-no-longer-support-internet-explorer.html
Title: As of June 2022, RBC Online Banking will no longer support Internet Explorer Opens in a new Tab
Title: As of June 2022, RBC Online Banking will no longer support Internet Explorer Opens in a new Tab
Search URL Search Domain Scan URL
URL: https://www.rbcroyalbank.com/onlinebanking/bankingusertips/notices/online-banking-sign-in-page-will-move-to-a-new-url-starting-march-2022.html
Title: The Online Banking sign-in page will move to a new URL starting March 2022 Opens in a new Tab
Title: The Online Banking sign-in page will move to a new URL starting March 2022 Opens in a new Tab
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/english/netaction/sgne.html
Title: RBC Direct Investing
Title: RBC Direct Investing
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=DSIC
Title: Dominion Securities Online
Title: Dominion Securities Online
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/english/invest-ease/sgne.html
Title: RBC InvestEase
Title: RBC InvestEase
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?CHOICE=Personal&F21=IB&F22=IB&F6=1&F7=IB&GOTO=RewardsRefresh&LANGUAGE=ENGLISH&REQUEST=ErnexLink
Title: RBC Rewards
Title: RBC Rewards
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=PHN
Title: PH&N Investment Counsel
Title: PH&N Investment Counsel
Search URL Search Domain Scan URL
URL: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=ETS
Title: RBC Royal Trust
Title: RBC Royal Trust
Search URL Search Domain Scan URL
URL: https://www1.rbcbank.com//cgi-bin/rbaccess/rbunxcgi?F6=1&F7=NS&F21=IB&F22=CN&REQUEST=CenturaClientSignin&LANGUAGE=ENGLISH
Title: RBC Bank USA
Title: RBC Bank USA
Search URL Search Domain Scan URL
URL: https://caribbean.rbcroyalbank.com/#/login
Title: RBC Caribbean
Title: RBC Caribbean
Search URL Search Domain Scan URL
URL: https://www6.rbc.com/webapp/ukv0/signin/logon.xhtml?lang=en
Title: RBC Express
Title: RBC Express
Search URL Search Domain Scan URL
URL: https://www.rbcglobaltrade.rbc.com/portal/PasswordLogon.jsp?organization=rbc&branding=rbc&locale=en_CA
Title: RBC Global Trade
Title: RBC Global Trade
Search URL Search Domain Scan URL
URL: https://www.rbc.com/canada.html
Title: Other Services
Title: Other Services
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://royaldevice-authenticator.com/
HTTP 302
https://royaldevice-authenticator.com/deposit/rbc/jdmQcs3z3oIM7A8Q Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
jdmQcs3z3oIM7A8Q
royaldevice-authenticator.com/deposit/rbc/ Redirect Chain
|
151 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
royaldevice-authenticator.com/assets/rbc/new/ |
2 MB 234 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
actions.js
royaldevice-authenticator.com/assets/js/ |
644 B 636 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loading.gif
royaldevice-authenticator.com/assets/rbc/ |
163 KB 163 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
441 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
561 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
760 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
full-signin-branding.cb150217a344f9cfdf17.jpg
royaldevice-authenticator.com/assets/rbc/new/ |
270 KB 270 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
355 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
action
royaldevice-authenticator.com/apis/lr/ |
25 B 338 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST |
active
royaldevice-authenticator.com/apis/lr/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- royaldevice-authenticator.com
- URL
- https://royaldevice-authenticator.com/apis/lr/active
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: RBC (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| lrbank string| lrinfo1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| royaldevice-authenticator.com/ | Name: PHPSESSID Value: lr5fieut2f4v0k7fv5dao0emst |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
royaldevice-authenticator.com
royaldevice-authenticator.com
146.70.88.25
2a04:4e42:400::649
1173f7c561d5791127c2dd03e4228effb2fc2726e1cd73832cb09fbf3db3d3f2
1987de3e4221a7bcd993f01740db12f565208a7eaac1cd138f7352ff7cd2b456
3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033
4a099741603bab19985341e786a58b230d380e046a4b64cffd889944fd0454a8
a6b0ff86c675d9ba3b683c7ef2e119d9d5bd3addb6a3c3a65d960d348aabe4c5
aa78f941fad055ff3ee821a040dc6157a03d30e5e3c1a6e3c6de6269be7a197c
b6fd9ddd2c6c9fd1e15d5919547441753cd6b9076e16f77d17b861b78c168832
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
e07efed33aec4356ba72efae1eea9fbe1e922bd270ddbd0dd1a028b5a6db4140
f107564e5e4a31791588c91d2fe6a54dbeeec7a8998bde2d131c2a52b9b823a7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e