urlscan.io logo urlscan.io
SecurityTrails logo

u1324717oe.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::39  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Submission: On November 26 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2a00:b700::39, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u1324717oe.ha004.t.justns.ru.
This is the only time u1324717oe.ha004.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Scotiabank (Banking)

Domain & IP information

IP Address AS Autonomous System
7 2a00:b700::39 51659 (ASBAXET)
2 2 104.111.241.15 16625 (AKAMAI-AS)
4 4 23.211.166.50 16625 (AKAMAI-AS)
2 23.37.35.213 16625 (AKAMAI-AS)
1 2 2a00:1450:400... 15169 (GOOGLE)
10 3
7    2a00:b700::39 (Russian Federation)

ASN51659 (ASBAXET, RU)
u1324717oe.ha004.t.justns.ru
2    104.111.241.15 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-241-15.deploy.static.akamaitechnologies.com
mobilebanking4.scotiabank.com
4    23.211.166.50 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-211-166-50.deploy.static.akamaitechnologies.com
secure.scotiabank.com
2    23.37.35.213 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-35-213.deploy.static.akamaitechnologies.com
auth.scotiaonline.scotiabank.com
2    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
Domain Requested by
7 u1324717oe.ha004.t.justns.ru u1324717oe.ha004.t.justns.ru
4 secure.scotiabank.com 4 redirects
2 www.googletagmanager.com 1 redirects u1324717oe.ha004.t.justns.ru
2 auth.scotiaonline.scotiabank.com u1324717oe.ha004.t.justns.ru
2 mobilebanking4.scotiabank.com 2 redirects
10 5

This site contains links to these domains. Also see Links.

Domain
mobilebanking1.scotiabank.com
www.scotiabank.com
www1.scotiaonline.scotiabank.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Frame ID: BC9E4EC5F02B034EE229485964F1F594
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Scotiabank-BankingWeb

Page Statistics

10
Requests

0 %
HTTPS

40 %
IPv6

3
Domains

5
Subdomains

3
IPs

2
Countries

303 kB
Transfer

934 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://mobilebanking4.scotiabank.com/bankingweb/css/css.css HTTP 301
  • https://secure.scotiabank.com/ HTTP 302
  • https://secure.scotiabank.com/auth/authorize?state=eyJyZXR1cm5VUkkiOiJodHRwczovL3NlY3VyZS5zY290aWFiYW5rLmNvbS8ifQ==&language=en HTTP 302
  • https://auth.scotiaonline.scotiabank.com/online?oauth_key=5Bx_fNVgVcA&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ1aV9sb2NhbGVzIjoiZW4iLCJvYXV0aF9rZXkiOiI1QnhfZk5WZ1ZjQSIsImNvbnNlbnRfcmVxdWlyZWQiOmZhbHNlLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvc2VjdXJlLnNjb3RpYWJhbmsuY29tXC9hdXRoXC9hdXRob3JpemF0aW9uIiwic3RhdGUiOiJleUp5WlhSMWNtNVZVa2tpT2lKb2RIUndjem92TDNObFkzVnlaUzV6WTI5MGFXRmlZVzVyTG1OdmJTOGlMQ0pqYzNKbVZHOXJaVzRpT2lKbFIxaHVaazQ1UnkwNGRFSkNSRUl4WjNkM1pHZ3daV2hKTW5CcU0wSjJlamRUUkVFaWZRJTNEJTNEIiwiZXhwIjoxNjM3ODkwMzc3LCJpYXQiOjE2Mzc4ODkxNzcsImp0aSI6IjcxYWUwY2UzLWZhYmQtNGU2Yy05MTM2LTJmODQ0N2VjMzYyZSIsImNsaWVudF9pZCI6IjRlY2Y3ZTM5LWJlNTYtNGE2Ni04MTZjLTEzY2I5NGU2MmRhNSIsImNsaWVudF9tZXRhZGF0YSI6eyJDaGFubmVsSUQiOiJNb2JpbGUiLCJBcHBsaWNhdGlvbkNvZGUiOiJJbVdBUCJ9LCJpc3N1ZXIiOiJodHRwczpcL1wvcGFzc3BvcnQuc2NvdGlhYmFuay5jb20ifQ.E5rjU3Md172eKpfIKGG4h4HaFF0mvTbTvPrkisd2xNavqvvRJKQFmsL4xk-b3lgllHynxDF7Rrlg9u-jVdyvcp5mGq7sYPx0yeggxsNWBfcorlsHvG8VJmg9RvCMWb-TR39r6PRv4eFib27Odvfrfgex89LR4QU_-FJ4wS7C3deS616FcGfWPU180Qq-MkIUMoe-8vHDlKGm3Fqy5k_rOPuM6LDYn4WR9Wrdby2CHuYI-gGO0d5lvbrmd4n_NUEsSlSf1PiFhcZN-F_kebLOTwmn-oWqbYWkpK9Ib6Serv4wLamZS98UYq7kyeXWNK9IYr8gSm4WYF0rLExH8FY0ew
Request Chain 3
  • https://mobilebanking4.scotiabank.com/bankingweb/images/en/login-logo.svg HTTP 301
  • https://secure.scotiabank.com/ HTTP 302
  • https://secure.scotiabank.com/auth/authorize?state=eyJyZXR1cm5VUkkiOiJodHRwczovL3NlY3VyZS5zY290aWFiYW5rLmNvbS8ifQ==&language=en HTTP 302
  • https://auth.scotiaonline.scotiabank.com/online?oauth_key=W2wse0N7c3k&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ1aV9sb2NhbGVzIjoiZW4iLCJvYXV0aF9rZXkiOiJXMndzZTBON2MzayIsImNvbnNlbnRfcmVxdWlyZWQiOmZhbHNlLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvc2VjdXJlLnNjb3RpYWJhbmsuY29tXC9hdXRoXC9hdXRob3JpemF0aW9uIiwic3RhdGUiOiJleUp5WlhSMWNtNVZVa2tpT2lKb2RIUndjem92TDNObFkzVnlaUzV6WTI5MGFXRmlZVzVyTG1OdmJTOGlMQ0pqYzNKbVZHOXJaVzRpT2lKb1VFaE9WMkZxYXkxWFZ6RlNaRWRJYzNNemJuUm9ZVlZGVFVGaGMyMUxkalpMVFhjaWZRJTNEJTNEIiwiZXhwIjoxNjM3ODkwMzc3LCJpYXQiOjE2Mzc4ODkxNzcsImp0aSI6IjllNmRmM2I4LTNmM2MtNDU3OC04MzRkLTUzYmE0MmE3MDIxMCIsImNsaWVudF9pZCI6IjRlY2Y3ZTM5LWJlNTYtNGE2Ni04MTZjLTEzY2I5NGU2MmRhNSIsImNsaWVudF9tZXRhZGF0YSI6eyJDaGFubmVsSUQiOiJNb2JpbGUiLCJBcHBsaWNhdGlvbkNvZGUiOiJJbVdBUCJ9LCJpc3N1ZXIiOiJodHRwczpcL1wvcGFzc3BvcnQuc2NvdGlhYmFuay5jb20ifQ.pBB4qx-89taj7PCKPm0nC5BfS7QQLnYtOpg5STx_5za4oeHFnqC9_Gd43lbGZk5MPLmEorVSYjcwcbDRnb1AOjJFgPrKE_59q8nntvhV3q81hlSCVvLZJUBxsTDpNKRIyb4ZCJ_bWX5ceZYdJf2vTQdQbRxZWKWEz3YZLZtVGCnqF9d8JpVQcNMLVUSYCkyEpPqO1e92XMj8j0EOtTp0lnMvP33mnQh2ADWedb2dyJ30L3Az8QAVGKC7x4EbVg02XOEV-9XNN4DB84iYzBT1srDcJD_2Cpz8vMHvkr0_KuLx288NJYVdP1Eo3mgLeukArZArKuPt6HvGYivOQBdUIA
Request Chain 5
  • http://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8 HTTP 302
  • https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Scotiabank-BankingWeb.html
u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/ 		16 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
7c0fd0be468a611f0cd72599ed62719af766b9c2e7311bf68f73c565be51553b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-type
text/html
last-modified
Wed, 18 Apr 2018 18:38:06 GMT
etag
"3fc8-5ad7908e-11c07317de82cea3;gz"
accept-ranges
bytes
content-encoding
gzip
vary
Accept-Encoding,User-Agent
content-length
4402
date
Fri, 26 Nov 2021 01:12:56 GMT
server
LiteSpeed
online
auth.scotiaonline.scotiabank.com/
Redirect Chain
  • https://mobilebanking4.scotiabank.com/bankingweb/css/css.css
  • https://secure.scotiabank.com/
  • https://secure.scotiabank.com/auth/authorize?state=eyJyZXR1cm5VUkkiOiJodHRwczovL3NlY3VyZS5zY290aWFiYW5rLmNvbS8ifQ==&language=en
  • https://auth.scotiaonline.scotiabank.com/online?oauth_key=5Bx_fNVgVcA&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ....
0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://auth.scotiaonline.scotiabank.com/online?oauth_key=5Bx_fNVgVcA&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ1aV9sb2NhbGVzIjoiZW4iLCJvYXV0aF9rZXkiOiI1QnhfZk5WZ1ZjQSIsImNvbnNlbnRfcmVxdWlyZWQiOmZhbHNlLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvc2VjdXJlLnNjb3RpYWJhbmsuY29tXC9hdXRoXC9hdXRob3JpemF0aW9uIiwic3RhdGUiOiJleUp5WlhSMWNtNVZVa2tpT2lKb2RIUndjem92TDNObFkzVnlaUzV6WTI5MGFXRmlZVzVyTG1OdmJTOGlMQ0pqYzNKbVZHOXJaVzRpT2lKbFIxaHVaazQ1UnkwNGRFSkNSRUl4WjNkM1pHZ3daV2hKTW5CcU0wSjJlamRUUkVFaWZRJTNEJTNEIiwiZXhwIjoxNjM3ODkwMzc3LCJpYXQiOjE2Mzc4ODkxNzcsImp0aSI6IjcxYWUwY2UzLWZhYmQtNGU2Yy05MTM2LTJmODQ0N2VjMzYyZSIsImNsaWVudF9pZCI6IjRlY2Y3ZTM5LWJlNTYtNGE2Ni04MTZjLTEzY2I5NGU2MmRhNSIsImNsaWVudF9tZXRhZGF0YSI6eyJDaGFubmVsSUQiOiJNb2JpbGUiLCJBcHBsaWNhdGlvbkNvZGUiOiJJbVdBUCJ9LCJpc3N1ZXIiOiJodHRwczpcL1wvcGFzc3BvcnQuc2NvdGlhYmFuay5jb20ifQ.E5rjU3Md172eKpfIKGG4h4HaFF0mvTbTvPrkisd2xNavqvvRJKQFmsL4xk-b3lgllHynxDF7Rrlg9u-jVdyvcp5mGq7sYPx0yeggxsNWBfcorlsHvG8VJmg9RvCMWb-TR39r6PRv4eFib27Odvfrfgex89LR4QU_-FJ4wS7C3deS616FcGfWPU180Qq-MkIUMoe-8vHDlKGm3Fqy5k_rOPuM6LDYn4WR9Wrdby2CHuYI-gGO0d5lvbrmd4n_NUEsSlSf1PiFhcZN-F_kebLOTwmn-oWqbYWkpK9Ib6Serv4wLamZS98UYq7kyeXWNK9IYr8gSm4WYF0rLExH8FY0ew
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
H2
Server
23.37.35.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-35-213.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy
no-referrer
date
Fri, 26 Nov 2021 01:12:58 GMT
x-frame-options
SAMEORIGIN
location
https://auth.scotiaonline.scotiabank.com/online?oauth_key=5Bx_fNVgVcA&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ1aV9sb2NhbGVzIjoiZW4iLCJvYXV0aF9rZXkiOiI1QnhfZk5WZ1ZjQSIsImNvbnNlbnRfcmVxdWlyZWQiOmZhbHNlLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvc2VjdXJlLnNjb3RpYWJhbmsuY29tXC9hdXRoXC9hdXRob3JpemF0aW9uIiwic3RhdGUiOiJleUp5WlhSMWNtNVZVa2tpT2lKb2RIUndjem92TDNObFkzVnlaUzV6WTI5MGFXRmlZVzVyTG1OdmJTOGlMQ0pqYzNKbVZHOXJaVzRpT2lKbFIxaHVaazQ1UnkwNGRFSkNSRUl4WjNkM1pHZ3daV2hKTW5CcU0wSjJlamRUUkVFaWZRJTNEJTNEIiwiZXhwIjoxNjM3ODkwMzc3LCJpYXQiOjE2Mzc4ODkxNzcsImp0aSI6IjcxYWUwY2UzLWZhYmQtNGU2Yy05MTM2LTJmODQ0N2VjMzYyZSIsImNsaWVudF9pZCI6IjRlY2Y3ZTM5LWJlNTYtNGE2Ni04MTZjLTEzY2I5NGU2MmRhNSIsImNsaWVudF9tZXRhZGF0YSI6eyJDaGFubmVsSUQiOiJNb2JpbGUiLCJBcHBsaWNhdGlvbkNvZGUiOiJJbVdBUCJ9LCJpc3N1ZXIiOiJodHRwczpcL1wvcGFzc3BvcnQuc2NvdGlhYmFuay5jb20ifQ.E5rjU3Md172eKpfIKGG4h4HaFF0mvTbTvPrkisd2xNavqvvRJKQFmsL4xk-b3lgllHynxDF7Rrlg9u-jVdyvcp5mGq7sYPx0yeggxsNWBfcorlsHvG8VJmg9RvCMWb-TR39r6PRv4eFib27Odvfrfgex89LR4QU_-FJ4wS7C3deS616FcGfWPU180Qq-MkIUMoe-8vHDlKGm3Fqy5k_rOPuM6LDYn4WR9Wrdby2CHuYI-gGO0d5lvbrmd4n_NUEsSlSf1PiFhcZN-F_kebLOTwmn-oWqbYWkpK9Ib6Serv4wLamZS98UYq7kyeXWNK9IYr8gSm4WYF0rLExH8FY0ew
x-vcap-request-id
6926741a-8d9c-4e98-5edf-41cf0059237c
x-xss-protection
0
content-length
0
x-content-type-options
nosniff
scripts.js
u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/ 		778 KB
207 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/scripts.js
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
af2f544a6c0fe78d7cdafd87b1bf2d65865c6823070fb88f029a8eb7851d1621

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 01:12:56 GMT
content-encoding
gzip
last-modified
Mon, 16 Apr 2018 09:01:36 GMT
server
LiteSpeed
etag
"c2913-5ad46670-72ec92e0278c4fa0;gz"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
211544
expires
Fri, 03 Dec 2021 01:12:56 GMT
logo.svg
u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/ 		12 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/logo.svg
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 01:12:56 GMT
content-encoding
gzip
last-modified
Mon, 16 Apr 2018 09:01:36 GMT
server
LiteSpeed
etag
"30d0-5ad46670-2632d444a172a9eb;gz"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
5631
expires
Fri, 03 Dec 2021 01:12:56 GMT
online
auth.scotiaonline.scotiabank.com/
Redirect Chain
  • https://mobilebanking4.scotiabank.com/bankingweb/images/en/login-logo.svg
  • https://secure.scotiabank.com/
  • https://secure.scotiabank.com/auth/authorize?state=eyJyZXR1cm5VUkkiOiJodHRwczovL3NlY3VyZS5zY290aWFiYW5rLmNvbS8ifQ==&language=en
  • https://auth.scotiaonline.scotiabank.com/online?oauth_key=W2wse0N7c3k&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ....
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auth.scotiaonline.scotiabank.com/online?oauth_key=W2wse0N7c3k&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ1aV9sb2NhbGVzIjoiZW4iLCJvYXV0aF9rZXkiOiJXMndzZTBON2MzayIsImNvbnNlbnRfcmVxdWlyZWQiOmZhbHNlLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvc2VjdXJlLnNjb3RpYWJhbmsuY29tXC9hdXRoXC9hdXRob3JpemF0aW9uIiwic3RhdGUiOiJleUp5WlhSMWNtNVZVa2tpT2lKb2RIUndjem92TDNObFkzVnlaUzV6WTI5MGFXRmlZVzVyTG1OdmJTOGlMQ0pqYzNKbVZHOXJaVzRpT2lKb1VFaE9WMkZxYXkxWFZ6RlNaRWRJYzNNemJuUm9ZVlZGVFVGaGMyMUxkalpMVFhjaWZRJTNEJTNEIiwiZXhwIjoxNjM3ODkwMzc3LCJpYXQiOjE2Mzc4ODkxNzcsImp0aSI6IjllNmRmM2I4LTNmM2MtNDU3OC04MzRkLTUzYmE0MmE3MDIxMCIsImNsaWVudF9pZCI6IjRlY2Y3ZTM5LWJlNTYtNGE2Ni04MTZjLTEzY2I5NGU2MmRhNSIsImNsaWVudF9tZXRhZGF0YSI6eyJDaGFubmVsSUQiOiJNb2JpbGUiLCJBcHBsaWNhdGlvbkNvZGUiOiJJbVdBUCJ9LCJpc3N1ZXIiOiJodHRwczpcL1wvcGFzc3BvcnQuc2NvdGlhYmFuay5jb20ifQ.pBB4qx-89taj7PCKPm0nC5BfS7QQLnYtOpg5STx_5za4oeHFnqC9_Gd43lbGZk5MPLmEorVSYjcwcbDRnb1AOjJFgPrKE_59q8nntvhV3q81hlSCVvLZJUBxsTDpNKRIyb4ZCJ_bWX5ceZYdJf2vTQdQbRxZWKWEz3YZLZtVGCnqF9d8JpVQcNMLVUSYCkyEpPqO1e92XMj8j0EOtTp0lnMvP33mnQh2ADWedb2dyJ30L3Az8QAVGKC7x4EbVg02XOEV-9XNN4DB84iYzBT1srDcJD_2Cpz8vMHvkr0_KuLx288NJYVdP1Eo3mgLeukArZArKuPt6HvGYivOQBdUIA
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
H2
Server
23.37.35.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-35-213.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy
no-referrer
date
Fri, 26 Nov 2021 01:12:57 GMT
x-frame-options
SAMEORIGIN
location
https://auth.scotiaonline.scotiabank.com/online?oauth_key=W2wse0N7c3k&oauth_key_signature=eyJraWQiOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1oX3BiZXNVIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJ1aV9sb2NhbGVzIjoiZW4iLCJvYXV0aF9rZXkiOiJXMndzZTBON2MzayIsImNvbnNlbnRfcmVxdWlyZWQiOmZhbHNlLCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvc2VjdXJlLnNjb3RpYWJhbmsuY29tXC9hdXRoXC9hdXRob3JpemF0aW9uIiwic3RhdGUiOiJleUp5WlhSMWNtNVZVa2tpT2lKb2RIUndjem92TDNObFkzVnlaUzV6WTI5MGFXRmlZVzVyTG1OdmJTOGlMQ0pqYzNKbVZHOXJaVzRpT2lKb1VFaE9WMkZxYXkxWFZ6RlNaRWRJYzNNemJuUm9ZVlZGVFVGaGMyMUxkalpMVFhjaWZRJTNEJTNEIiwiZXhwIjoxNjM3ODkwMzc3LCJpYXQiOjE2Mzc4ODkxNzcsImp0aSI6IjllNmRmM2I4LTNmM2MtNDU3OC04MzRkLTUzYmE0MmE3MDIxMCIsImNsaWVudF9pZCI6IjRlY2Y3ZTM5LWJlNTYtNGE2Ni04MTZjLTEzY2I5NGU2MmRhNSIsImNsaWVudF9tZXRhZGF0YSI6eyJDaGFubmVsSUQiOiJNb2JpbGUiLCJBcHBsaWNhdGlvbkNvZGUiOiJJbVdBUCJ9LCJpc3N1ZXIiOiJodHRwczpcL1wvcGFzc3BvcnQuc2NvdGlhYmFuay5jb20ifQ.pBB4qx-89taj7PCKPm0nC5BfS7QQLnYtOpg5STx_5za4oeHFnqC9_Gd43lbGZk5MPLmEorVSYjcwcbDRnb1AOjJFgPrKE_59q8nntvhV3q81hlSCVvLZJUBxsTDpNKRIyb4ZCJ_bWX5ceZYdJf2vTQdQbRxZWKWEz3YZLZtVGCnqF9d8JpVQcNMLVUSYCkyEpPqO1e92XMj8j0EOtTp0lnMvP33mnQh2ADWedb2dyJ30L3Az8QAVGKC7x4EbVg02XOEV-9XNN4DB84iYzBT1srDcJD_2Cpz8vMHvkr0_KuLx288NJYVdP1Eo3mgLeukArZArKuPt6HvGYivOQBdUIA
x-vcap-request-id
535f65b2-577f-4652-4f8b-f8c8e3313a69
x-xss-protection
0
content-length
0
x-content-type-options
nosniff
bd-1-29
u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/ 		54 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/bd-1-29
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
0e3ca5ff965bf78ca037fe0bb07e7e0e3af713b327a411068b2ca5f0abc3cdd0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 01:12:56 GMT
last-modified
Mon, 16 Apr 2018 09:01:36 GMT
server
LiteSpeed
etag
"d6bb-5ad46670-3a90acc7cdcc2380;;;"
vary
User-Agent
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
54971
gtm.js
www.googletagmanager.com/
Redirect Chain
  • http://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
  • https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
73 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Protocol
H2
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4302d5f96dde9ef56ac818cbcf3836c3aa4b3be5adfb801014c8f2c0f9825e58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 01:12:58 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29551
x-xss-protection
0
last-modified
Fri, 26 Nov 2021 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 26 Nov 2021 01:12:58 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtm.js?id=GTM-MSJKZ8
Date
Fri, 26 Nov 2021 01:12:58 GMT
Cross-Origin-Resource-Policy
cross-origin
Server
Google Tag Manager
Content-Length
250
X-XSS-Protection
0
Content-Type
text/html; charset=UTF-8
_data
u1324717oe.ha004.t.justns.ru/_bm/ 		350 B
535 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://u1324717oe.ha004.t.justns.ru/_bm/_data
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/bd-1-29
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
04a26f17adc74030c6fd95718c2e2e4aa97114107ad2ac3d7e1d4a49358b72e1

Request headers

Referer
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 26 Nov 2021 01:12:58 GMT
content-encoding
gzip
server
LiteSpeed
Connection
close
content-length
330
vary
Accept-Encoding,User-Agent
content-type
text/html
translation.json
u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/locales/en-US/ 		452 B
652 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/locales/en-US/translation.json?_=1637889178322
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/scripts.js
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
07fbf8a6b0099d20fdacd94a3a5c0ab0710d94b39b086794847f3a1eace8c522

Request headers

accept
*/*
Referer
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

date
Fri, 26 Nov 2021 01:12:58 GMT
content-encoding
gzip
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/html
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
410
translation.json
u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/locales/en/ 		449 B
649 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/locales/en/translation.json?_=1637889178322
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/files/scripts.js
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
75eafb0a42b09edaa7f072a89b0ff47bcea09c028184d7cf7449907748e90aca

Request headers

accept
*/*
Referer
http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/Scotiabank-BankingWeb.html
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

date
Fri, 26 Nov 2021 01:12:58 GMT
content-encoding
gzip
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
text/html
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
407

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| dataLayer function| requirejs function| require function| define function| $ function| jQuery object| html5 object| Modernizr object| Foundation object| usedVer object| BnsTmxLoader object| _cf object| _ac object| cf string| _sd_trace object| BankingJS string| feature object| google_tag_manager

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: http://u1324717oe.ha004.t.justns.ru/_bm/_data
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/locales/en/translation.json?_=1637889178322
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://u1324717oe.ha004.t.justns.ru/directing/www2.scotiaonline.scotiabank.com/online/authentication/locales/en-US/translation.json?_=1637889178322
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)