buffalous.com Open in urlscan Pro
174.136.57.205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://buffalous.com/Bankofamerica/security.php
Submission: On February 07 via automatic, source openphish (February 7th 2017, 5:20:41 pm UTC)

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 18 HTTP transactions. The main IP is 174.136.57.205, located in Saint Louis, United States and belongs to COLO4-CO - Colo4, LLC, US. The main domain is buffalous.com.

This is the only time buffalous.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	174.136.57.205 174.136.57.205	36024 (COLO4-CO) (COLO4-CO - Colo4)
3	208.89.15.4 208.89.15.4	11054 (LIVEPERSON) (LIVEPERSON - LivePerson)
1	171.161.207.200 171.161.207.200	10794 (BANKAMERICA) (BANKAMERICA - Bank of America)
18	3

14 174.136.57.205 (Saint Louis, United States)

ASN36024 (COLO4-CO - Colo4, LLC, US)
PTR: king.vivawebhost.com

buffalous.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 208.89.15.4 (New York, United States)

ASN11054 (LIVEPERSON - LivePerson, Inc., US)
PTR: intranet.liveperson.com

chat.bankofamerica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 171.161.207.200 (Concord, United States)

ASN10794 (BANKAMERICA - Bank of America, US)

secure.bankofamerica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	buffalous.com buffalous.com	248 KB
4	bankofamerica.com chat.bankofamerica.com secure.bankofamerica.com	37 KB
18	2

	Domain	Requested by
14	buffalous.com	buffalous.com
3	chat.bankofamerica.com	buffalous.com
1	secure.bankofamerica.com
18	3

This site contains no links.

Subject Issuer	Validity	Valid
secure.bankofamerica.com Symantec Class 3 EV SSL CA - G3	`2016-10-21` - `2017-10-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://buffalous.com/Bankofamerica/security.php
Frame ID: 16302.1
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

18
Requests

6 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

285 kB
Transfer

1004 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request security.php Show response buffalous.com/Bankofamerica/	28 KB 7 KB	511ms 147ms	Document text/html	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `b8723f23e9b68888926395e7511bcaa6df18a944b9cd940bc24b3f856330dafd` Request headers Pragma no-cache Host buffalous.com Cache-Control no-cache Accept-Encoding gzip, deflate, sdch Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Upgrade-Insecure-Requests 1 Response headers Server LiteSpeed Cache-Control public, max-age=31536000 Date Tue, 07 Feb 2017 17:20:32 GMT Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Connection close Accept-Ranges bytes Expires Wed, 07 Feb 2018 17:20:32 GMT Content-Encoding gzip Transfer-Encoding chunked
GET H/1.1	200 OK	global-jawr.css buffalous.com/Bankofamerica/files/	90 KB 18 KB	128ms 127ms	Stylesheet text/css	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/global-jawr.css Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `15e295aa25dc34c6096bbc1ac5ecfe8a2d3903b5c1ef126222388edae9266383` Request headers Accept-Language en-US,en;q=0.8 Accept text/css,/;q=0.1 Referer http://buffalous.com/Bankofamerica/security.php Cache-Control no-cache Pragma no-cache Accept-Encoding gzip, deflate, sdch Host buffalous.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Connection keep-alive Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Expires Tue, 14 Feb 2017 17:20:33 GMT Content-Length 18015 Date Tue, 07 Feb 2017 17:20:33 GMT Last-Modified Fri, 04 Oct 2013 05:00:32 GMT ETag "166a7-524e4b70-4c9aa07cd690fb25" Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Accept-Ranges bytes
GET H/1.1	200 OK	vipaa-jawr.css buffalous.com/Bankofamerica/files/	184 KB 33 KB	252ms 125ms	Stylesheet text/css	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/vipaa-jawr.css Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `09a54bbb2061a17e8895e42f87442d2ff1648fb89f5246fc64b5eaa9e04fc4f0` Request headers Host buffalous.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Connection keep-alive Pragma no-cache Accept-Language en-US,en;q=0.8 Accept text/css,/;q=0.1 Referer http://buffalous.com/Bankofamerica/security.php Cache-Control no-cache Accept-Encoding gzip, deflate, sdch Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Date Tue, 07 Feb 2017 17:20:33 GMT ETag "2dfb4-524e4b70-24fe8874b11f9a1e" Vary Accept-Encoding Content-Type text/css Content-Length 33731 Expires Tue, 14 Feb 2017 17:20:33 GMT Content-Encoding gzip Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Server LiteSpeed
GET H/1.1	200 OK	global-jawr.js Show response buffalous.com/Bankofamerica/files/	270 KB 87 KB	254ms 127ms	Script application/javascript	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/global-jawr.js Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `7a351c2fda295ba9e270f6830f4efcaedd5e3b5c818aa2527e47561fac1b80e9` Request headers Host buffalous.com Accept / Cache-Control no-cache Referer http://buffalous.com/Bankofamerica/security.php Connection keep-alive Pragma no-cache Accept-Encoding gzip, deflate, sdch Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Server LiteSpeed ETag "437c9-524e4b70-a04a469ada8eef77" Content-Type application/javascript Connection Keep-Alive Content-Length 89179 Date Tue, 07 Feb 2017 17:20:33 GMT Content-Encoding gzip Vary Accept-Encoding Cache-Control public, max-age=604800 Accept-Ranges bytes Expires Tue, 14 Feb 2017 17:20:33 GMT
GET H/1.1	200 OK	vipaa-jawr.js Show response buffalous.com/Bankofamerica/files/	328 KB 72 KB	255ms 127ms	Script application/javascript	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/vipaa-jawr.js Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `21b3661992e30a5f959ac0d9a267f8a78bd696ac89943c174f75e631d459fe1d` Request headers Referer http://buffalous.com/Bankofamerica/security.php Connection keep-alive Cache-Control no-cache Accept-Encoding gzip, deflate, sdch Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Pragma no-cache Host buffalous.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Response headers Server LiteSpeed ETag "51e26-524e4b70-bb943b0d0cb67977" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Expires Tue, 14 Feb 2017 17:20:33 GMT Date Tue, 07 Feb 2017 17:20:33 GMT Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Cache-Control public, max-age=604800 Accept-Ranges bytes Content-Length 73295 Content-Encoding gzip
GET H/1.1	200 OK	deploy2.js Show response buffalous.com/Bankofamerica/files/	20 KB 6 KB	255ms 127ms	Script application/javascript	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/deploy2.js Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `3d76e5ba2c6ead84f5578ca057b443ebf014eb22d8cd6c756103da606e9234ec` Request headers Pragma no-cache Connection keep-alive Cache-Control no-cache Accept / Referer http://buffalous.com/Bankofamerica/security.php Accept-Encoding gzip, deflate, sdch Host buffalous.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Content-Encoding gzip Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Content-Length 6195 Date Tue, 07 Feb 2017 17:20:33 GMT Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Server LiteSpeed ETag "50ce-524e4b70-7d9595c8d0c1d4a7" Vary Accept-Encoding Cache-Control public, max-age=604800 Expires Tue, 14 Feb 2017 17:20:33 GMT
GET H/1.1	200 OK	mTag.js Show response buffalous.com/Bankofamerica/files/	17 KB 13 KB	255ms 127ms	Script application/javascript	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/mTag.js Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `345acf1ee9f04ca7cab13430f189935b04bba50bdc7178cd510dbeb5e63fd253` Request headers Pragma no-cache Host buffalous.com Accept-Language en-US,en;q=0.8 Accept / Connection keep-alive Cache-Control no-cache Accept-Encoding gzip, deflate, sdch User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Cache-Control public, max-age=604800 Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Server LiteSpeed ETag "43c7-524e4b70-50e145e80c1687a3" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Content-Length 13294 Expires Tue, 14 Feb 2017 17:20:33 GMT Date Tue, 07 Feb 2017 17:20:33 GMT Content-Encoding gzip Vary Accept-Encoding
GET H/1.1	200 OK	bac_reg_logo_tmp_250X69.gif buffalous.com/Bankofamerica/files/	4 KB 4 KB	127ms 126ms	Image image/gif	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Show image Full URL http://buffalous.com/Bankofamerica/files/bac_reg_logo_tmp_250X69.gif Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host buffalous.com Accept image/webp,image/,/;q=0.8 Connection* keep-alive Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Cache-Control no-cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Response headers Content-Length 3596 Date Tue, 07 Feb 2017 17:20:33 GMT ETag "e0c-524e4b70-3fd13afd2f901775" Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Server LiteSpeed Accept-Ranges bytes Expires Tue, 14 Feb 2017 17:20:33 GMT
GET H/1.1	200 OK	continue.jpg buffalous.com/Bankofamerica/	2 KB 2 KB	125ms 125ms	Image image/jpeg	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Show image Full URL http://buffalous.com/Bankofamerica/continue.jpg Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `716d41b4ff253cccbf90f548b06b866d2bb12566ae81fb8fb8eee9380c0144ba` Request headers Accept-Language en-US,en;q=0.8 Cache-Control no-cache Accept image/webp,image/,/;q=0.8 Referer* http://buffalous.com/Bankofamerica/security.php Connection keep-alive Pragma no-cache Accept-Encoding gzip, deflate, sdch Host buffalous.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Last-Modified Mon, 04 Nov 2013 18:53:36 GMT Server LiteSpeed Content-Type image/jpeg Content-Length 1861 Expires Tue, 14 Feb 2017 17:20:33 GMT Date Tue, 07 Feb 2017 17:20:33 GMT Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes ETag "745-5277ed30-680d680da3dc285e"
GET H/1.1	200 OK	mtagconfig.js Show response buffalous.com/Bankofamerica/files/	4 KB 1 KB	127ms 127ms	Script application/javascript	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Full URL http://buffalous.com/Bankofamerica/files/mtagconfig.js Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `7fa4b8e6a601d0b18b51d24b96cc52e73484bf3ef3daa40cd27f5a4c3d4ab353` Request headers Connection keep-alive Cache-Control no-cache Accept-Encoding gzip, deflate, sdch Host buffalous.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Pragma no-cache Accept / Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Expires Tue, 14 Feb 2017 17:20:33 GMT Content-Encoding gzip Server LiteSpeed ETag "fc9-524e4b70-c4c11e92fd370885" Cache-Control public, max-age=604800 Connection Keep-Alive Content-Length 1385 Date Tue, 07 Feb 2017 17:20:33 GMT Last-Modified Fri, 04 Oct 2013 05:00:32 GMT Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes
GET H/1.1	404 Not Found	Cookie set fsd-secure-esp-sprite.png buffalous.com/pa/components/modules/header-module/2.1/graphic/	3 KB 931 B	235ms 234ms	Image text/html	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Show image Full URL http://buffalous.com/pa/components/modules/header-module/2.1/graphic/fsd-secure-esp-sprite.png Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `3e67a40f89f5cda6318856430f00787066d2105c6a27833217f9dd251caf59b0` Request headers Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/files/vipaa-jawr.css Connection keep-alive Pragma no-cache Accept-Encoding gzip, deflate, sdch Host buffalous.com Accept image/webp,image/,/;q=0.8 Cache-Control* no-cache Referer http://buffalous.com/Bankofamerica/files/vipaa-jawr.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Tue, 07 Feb 2017 17:20:33 GMT Server LiteSpeed Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Set-Cookie frontend=ertqml3fu0hh5ref1lu00igek5; expires=Tue, 07-Feb-2017 18:20:33 GMT; Max-Age=3600; path=/; domain=buffalous.com; HttpOnly Transfer-Encoding chunked Connection close Accept-Ranges bytes Pragma no-cache Content-Encoding gzip Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	404 Not Found	Cookie set fsd-arrows.png buffalous.com/pa/components/modules/quick-help-module/2.0/graphic/	3 KB 931 B	213ms 212ms	Image text/html	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Show image Full URL http://buffalous.com/pa/components/modules/quick-help-module/2.0/graphic/fsd-arrows.png Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `3e67a40f89f5cda6318856430f00787066d2105c6a27833217f9dd251caf59b0` Request headers Accept-Encoding gzip, deflate, sdch Host buffalous.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Cache-Control no-cache Pragma no-cache Accept-Language en-US,en;q=0.8 Accept image/webp,image/,/;q=0.8 Referer* http://buffalous.com/Bankofamerica/files/vipaa-jawr.css Connection keep-alive Referer http://buffalous.com/Bankofamerica/files/vipaa-jawr.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Server LiteSpeed Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Transfer-Encoding chunked Connection close Accept-Ranges bytes Pragma no-cache Date Tue, 07 Feb 2017 17:20:33 GMT Content-Encoding gzip Expires Thu, 19 Nov 1981 08:52:00 GMT Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Set-Cookie frontend=194ciaoo4t4m3m6qfare1utmt4; expires=Tue, 07-Feb-2017 18:20:33 GMT; Max-Age=3600; path=/; domain=buffalous.com; HttpOnly
GET H/1.1	404 Not Found	Cookie set gfootb-static-sprite.png buffalous.com/pa/components/modules/global-footer-module/2.5/graphic/	11 KB 3 KB	429ms 429ms	Image text/html	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Show image Full URL http://buffalous.com/pa/components/modules/global-footer-module/2.5/graphic/gfootb-static-sprite.png Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/files/global-jawr.js Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `73f532675e762f92ec3655dec522aa164b7d6e0b4b83c73c3af7fc5c3320ce3f` Request headers Accept-Encoding gzip, deflate, sdch User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://buffalous.com/Bankofamerica/files/vipaa-jawr.css Cache-Control no-cache Pragma no-cache Host buffalous.com Accept-Language en-US,en;q=0.8 Connection keep-alive Referer http://buffalous.com/Bankofamerica/files/vipaa-jawr.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Date Tue, 07 Feb 2017 17:20:33 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Accept-Ranges bytes Content-Encoding gzip Server LiteSpeed Vary Accept-Encoding Set-Cookie frontend=smb28ehcbdmobfog0e1nkucsv3; expires=Tue, 07-Feb-2017 18:20:33 GMT; Max-Age=3600; path=/; domain=buffalous.com; HttpOnly
GET H/1.1	404 Not Found	Cookie set gfoot-home-icon.png buffalous.com/pa/components/modules/global-footer-module/2.5/graphic/	3 KB 931 B	431ms 431ms	Image text/html	174.136.57.205 Colo4
General Check archive.org Show headers Download Go to Show image Full URL http://buffalous.com/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/files/global-jawr.js Protocol HTTP/1.1 Server 174.136.57.205 Saint Louis, United States, ASN36024 (COLO4-CO - Colo4, LLC, US), Reverse DNS king.vivawebhost.com Software LiteSpeed / Resource Hash `3e67a40f89f5cda6318856430f00787066d2105c6a27833217f9dd251caf59b0` Request headers Host buffalous.com Accept image/webp,image/,/;q=0.8 Referer* http://buffalous.com/Bankofamerica/files/vipaa-jawr.css Pragma no-cache Accept-Encoding gzip, deflate, sdch Connection keep-alive Cache-Control no-cache Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/files/vipaa-jawr.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Content-Encoding gzip Server LiteSpeed Vary Accept-Encoding Set-Cookie frontend=86vbvaemkhh5ut2c3q37ptdag7; expires=Tue, 07-Feb-2017 18:20:33 GMT; Max-Age=3600; path=/; domain=buffalous.com; HttpOnly Transfer-Encoding chunked Connection close Accept-Ranges bytes Pragma no-cache Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires Thu, 19 Nov 1981 08:52:00 GMT Date Tue, 07 Feb 2017 17:20:33 GMT
GET H/1.1	200 OK	deploy2.asp Show response chat.bankofamerica.com/visitor/addons/	20 KB 20 KB	329ms 127ms	Script application/x-javascript	208.89.15.4 LivePerson
General Check archive.org Show headers Download Go to Full URL http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/files/mtagconfig.js Protocol HTTP/1.1 Server 208.89.15.4 New York, United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US), Reverse DNS intranet.liveperson.com Software WS / Resource Hash `3d76e5ba2c6ead84f5578ca057b443ebf014eb22d8cd6c756103da606e9234ec` Request headers Accept-Encoding gzip, deflate, sdch Accept-Language en-US,en;q=0.8 Connection keep-alive Cache-Control no-cache Pragma no-cache Host chat.bankofamerica.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Response headers Cache-Control public, max-age=3600, s-maxage=3600 Last-Modified Thu, 26 May 2016 05:53:35 GMT Server WS Content-Type application/x-javascript Content-Length 20686 P3P CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" Date Tue, 07 Feb 2017 17:20:34 GMT
GET H/1.1	200 OK	favicon.ico secure.bankofamerica.com/pa/global-assets/1.0/graphic/	318 B 182 B	825ms 105ms	Other image/x-icon	171.161.207.200 Bank of America
General Check archive.org Show headers Download Go to Full URL https://secure.bankofamerica.com/pa/global-assets/1.0/graphic/favicon.ico Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 171.161.207.200 Concord, United States, ASN10794 (BANKAMERICA - Bank of America, US), Reverse DNS Software / Resource Hash `97ac0743dec6f7dc9326192d642ae23bfbd0afc3601cc192462c6eb6f5ec1224` Request headers Accept image/webp,image/,/;q=0.8 Referer* http://buffalous.com/Bankofamerica/security.php Connection keep-alive Cache-Control no-cache Accept-Encoding gzip, deflate, sdch, br Host secure.bankofamerica.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Pragma no-cache Accept-Language en-US,en;q=0.8 Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Content-Encoding gzip Accept-Ranges bytes Date Tue, 07 Feb 2017 17:20:35 GMT X-Serviced-By rleE8RCW3a32zUGJ0gwaPg==--P9NlsCmGA/CSfHHClt/0cw== Content-Length 182 Age 639 ETag "13e-5406c05f2d800" Connection Keep-Alive Keep-Alive timeout=5, max=498 Expires Wed, 07 Feb 2018 17:09:56 GMT Last-Modified Thu, 03 Nov 2016 21:13:04 GMT X-BOA-RequestID wi7uFqdGrj8AAXOOAMkAAAC2 Vary Accept-Encoding Content-Type image/x-icon Cache-Control max-age=31536000
GET H/1.1	200 OK	mTag.js Show response chat.bankofamerica.com/hcp/html/	17 KB 17 KB	100ms 99ms	Script application/javascript	208.89.15.4 LivePerson
General Check archive.org Show headers Download Go to Full URL http://chat.bankofamerica.com/hcp/html/mTag.js?site=LPBofA2 Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/files/mtagconfig.js Protocol HTTP/1.1 Server 208.89.15.4 New York, United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US), Reverse DNS intranet.liveperson.com Software WS / Resource Hash `345acf1ee9f04ca7cab13430f189935b04bba50bdc7178cd510dbeb5e63fd253` Request headers Cache-Control no-cache Accept-Encoding gzip, deflate, sdch Host chat.bankofamerica.com Accept / Referer http://buffalous.com/Bankofamerica/security.php Pragma no-cache Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Connection keep-alive Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Accept-Ranges bytes Content-Length 17351 Date Tue, 07 Feb 2017 17:20:34 GMT Last-Modified Wed, 23 Jan 2013 21:06:10 GMT Server WS P3P CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" ETag "a01e7a78adf9cd1:0" Content-Type application/javascript
GET H/1.1	200 OK	Cookie set / Show response chat.bankofamerica.com/hc/LPBofA2/	107 B 107 B	106ms 106ms	Script application/x-javascript	208.89.15.4 LivePerson
General Check archive.org Show headers Download Go to Full URL http://chat.bankofamerica.com/hc/LPBofA2/?&site=LPBofA2&cmd=mTagKnockPage&lpCallId=848190552963-63540798193&protV=20&lpjson=1&id=8958714472&javaSupport=false&visitorStatus=INSITE_STATUS&dbut=chat-olb-passcode-model-SiteKeyCreation-SelectQuestionsAnswers-english%7ClpMTagConfig.db1%7ClpButtonDiv%7C Requested by Host: buffalous.com URL: http://buffalous.com/Bankofamerica/security.php Protocol HTTP/1.1 Server 208.89.15.4 New York, United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US), Reverse DNS intranet.liveperson.com Software WS / Resource Hash `ff9b1e0a523d25a5d6f37dacfc8291faec013708bb8d470a8784bc34180215a4` Request headers Accept-Encoding gzip, deflate, sdch User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Referer http://buffalous.com/Bankofamerica/security.php Connection keep-alive Pragma no-cache Host chat.bankofamerica.com Accept-Language en-US,en;q=0.8 Accept / Cache-Control no-cache Referer http://buffalous.com/Bankofamerica/security.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Expires Wed, 31 Dec 1969 23:59:59 GMT Pragma no-cache Last-Modified Tue, 07 Feb 2017 17:20:35 GMT Content-Length 107 Content-Type application/x-javascript Cache-Control no-store Set-Cookie LivePersonID=LP i=131310156390190,d=1486488035; expires=Wed, 07-Feb-2018 17:20:35 GMT; path=/; secure Accept-Ranges bytes Date Tue, 07 Feb 2017 17:20:34 GMT Server WS P3P CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.buffalous.com/	2017-02-07 18:20:34	Name: frontend Value: 86vbvaemkhh5ut2c3q37ptdag7

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy(Line 69) Message: DEBUG:simpleDeploy init
console-api	log	URL: http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy(Line 69) Message: DEBUG:simpleDeploy setup
console-api	log	URL: http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy(Line 69) Message: DEBUG:genericEventsBridge init
console-api	log	URL: http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy(Line 69) Message: DEBUG:genericEventsBridge start
console-api	log	URL: http://chat.bankofamerica.com/visitor/addons/deploy2.asp?site=LPBofA2&d_id=olb-passcode-english&default=simpleDeploy(Line 69) Message: DEBUG:Removing dynButton chat-olb-passcode-model-GlobalErrorMessage-english

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

buffalous.com
chat.bankofamerica.com
secure.bankofamerica.com
171.161.207.200
174.136.57.205
208.89.15.4
0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72
09a54bbb2061a17e8895e42f87442d2ff1648fb89f5246fc64b5eaa9e04fc4f0
15e295aa25dc34c6096bbc1ac5ecfe8a2d3903b5c1ef126222388edae9266383
21b3661992e30a5f959ac0d9a267f8a78bd696ac89943c174f75e631d459fe1d
345acf1ee9f04ca7cab13430f189935b04bba50bdc7178cd510dbeb5e63fd253
3d76e5ba2c6ead84f5578ca057b443ebf014eb22d8cd6c756103da606e9234ec
3e67a40f89f5cda6318856430f00787066d2105c6a27833217f9dd251caf59b0
716d41b4ff253cccbf90f548b06b866d2bb12566ae81fb8fb8eee9380c0144ba
73f532675e762f92ec3655dec522aa164b7d6e0b4b83c73c3af7fc5c3320ce3f
7a351c2fda295ba9e270f6830f4efcaedd5e3b5c818aa2527e47561fac1b80e9
7fa4b8e6a601d0b18b51d24b96cc52e73484bf3ef3daa40cd27f5a4c3d4ab353
97ac0743dec6f7dc9326192d642ae23bfbd0afc3601cc192462c6eb6f5ec1224
b8723f23e9b68888926395e7511bcaa6df18a944b9cd940bc24b3f856330dafd
ff9b1e0a523d25a5d6f37dacfc8291faec013708bb8d470a8784bc34180215a4

buffalous.com Open in urlscan Pro 174.136.57.205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

18 Requests

6 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

285 kBTransfer

1004 kBSize

1 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

5 Console Messages

Indicators

buffalous.com Open in urlscan Pro
174.136.57.205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

6 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

285 kB
Transfer

1004 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!