![](/screenshots/a63ad66c-d5e6-45bc-b9e3-da4ef385d14f.png)
citizenlogin.c1.is
Open in
urlscan Pro
198.45.114.194
Malicious Activity!
Public Scan
Submission: On December 01 via manual from US — Scanned from IS
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on November 28th 2023. Valid for: 3 months.
This is the only time citizenlogin.c1.is was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citizens Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 198.45.114.194 198.45.114.194 | 398395 (DOT-TECH-LLC) (DOT-TECH-LLC) | |
3 | 65.9.66.34 65.9.66.34 | 16509 (AMAZON-02) (AMAZON-02) | |
22 | 23.45.102.71 23.45.102.71 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 178.249.97.23 178.249.97.23 | 11054 (LIVEPERSON) (LIVEPERSON) | |
2 | 13.227.219.115 13.227.219.115 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 178.249.97.99 178.249.97.99 | 11054 (LIVEPERSON) (LIVEPERSON) | |
7 | 34.120.154.120 34.120.154.120 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 151.101.65.175 151.101.65.175 | 54113 (FASTLY) (FASTLY) | |
1 | 104.18.14.22 104.18.14.22 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 35.241.45.82 35.241.45.82 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 208.89.15.170 208.89.15.170 | 11054 (LIVEPERSON) (LIVEPERSON) | |
2 | 35.168.182.7 35.168.182.7 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 208.89.12.87 208.89.12.87 | 11054 (LIVEPERSON) (LIVEPERSON) | |
54 | 14 |
ASN398395 (DOT-TECH-LLC, US)
PTR: client.aquatis.host
citizenlogin.c1.is |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-34.fra56.r.cloudfront.net
nexus.ensighten.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-102-71.deploy.static.akamaitechnologies.com
www3.citizensbankonline.com | |
www4.citizensbankonline.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-115.ams54.r.cloudfront.net
cdn.appdynamics.com |
ASN11054 (LIVEPERSON, US)
PTR: lo-accdn.lpsnmedia.net
accdn.lpsnmedia.net |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 120.154.120.34.bc.googleusercontent.com
lpcdn.lpsnmedia.net |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 82.45.241.35.bc.googleusercontent.com
udc-neb.kampyle.com |
ASN11054 (LIVEPERSON, US)
PTR: va.idp.liveperson.net
va.idp.liveperson.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-182-7.compute-1.amazonaws.com
report.citizen.glassboxdigital.io |
ASN11054 (LIVEPERSON, US)
PTR: va.v.liveperson.net
va.v.liveperson.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
citizensbankonline.com
www3.citizensbankonline.com — Cisco Umbrella Rank: 432434 www4.citizensbankonline.com — Cisco Umbrella Rank: 414990 |
219 KB |
10 |
lpsnmedia.net
accdn.lpsnmedia.net — Cisco Umbrella Rank: 3541 lpcdn.lpsnmedia.net — Cisco Umbrella Rank: 3853 |
354 KB |
5 |
liveperson.net
lptag.liveperson.net — Cisco Umbrella Rank: 3640 va.idp.liveperson.net — Cisco Umbrella Rank: 9063 va.v.liveperson.net — Cisco Umbrella Rank: 3865 |
134 KB |
5 |
c1.is
citizenlogin.c1.is |
7 KB |
3 |
kampyle.com
nebula-cdn.kampyle.com — Cisco Umbrella Rank: 4226 udc-neb.kampyle.com — Cisco Umbrella Rank: 2096 |
123 KB |
3 |
ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3429 |
20 KB |
2 |
glassboxdigital.io
report.citizen.glassboxdigital.io — Cisco Umbrella Rank: 57413 |
3 KB |
2 |
appdynamics.com
cdn.appdynamics.com — Cisco Umbrella Rank: 4227 |
64 KB |
1 |
glassboxcdn.com
cdn.glassboxcdn.com — Cisco Umbrella Rank: 12152 |
138 KB |
54 | 9 |
Domain | Requested by | |
---|---|---|
21 | www3.citizensbankonline.com |
citizenlogin.c1.is
www3.citizensbankonline.com |
7 | lpcdn.lpsnmedia.net |
cdn.appdynamics.com
|
5 | citizenlogin.c1.is |
citizenlogin.c1.is
|
3 | accdn.lpsnmedia.net |
cdn.appdynamics.com
lpcdn.lpsnmedia.net |
3 | nexus.ensighten.com |
citizenlogin.c1.is
nexus.ensighten.com |
2 | report.citizen.glassboxdigital.io |
cdn.appdynamics.com
|
2 | va.idp.liveperson.net |
cdn.appdynamics.com
va.idp.liveperson.net |
2 | nebula-cdn.kampyle.com |
cdn.appdynamics.com
|
2 | cdn.appdynamics.com |
nexus.ensighten.com
cdn.appdynamics.com |
2 | lptag.liveperson.net |
citizenlogin.c1.is
cdn.appdynamics.com |
1 | va.v.liveperson.net |
cdn.appdynamics.com
|
1 | udc-neb.kampyle.com | |
1 | cdn.glassboxcdn.com |
cdn.appdynamics.com
|
1 | www4.citizensbankonline.com |
citizenlogin.c1.is
|
54 | 14 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.citizensbank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
citizenlogin.c1.is ZeroSSL RSA Domain Secure Site CA |
2023-11-28 - 2024-02-26 |
3 months | crt.sh |
nexus.ensighten.com Amazon RSA 2048 M02 |
2023-09-29 - 2024-10-27 |
a year | crt.sh |
citizensbankonline.com Entrust Certification Authority - L1M |
2023-03-03 - 2024-04-03 |
a year | crt.sh |
*.liveperson.net Sectigo RSA Organization Validation Secure Server CA |
2023-02-07 - 2024-02-07 |
a year | crt.sh |
*.appdynamics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-06-21 - 2024-07-21 |
a year | crt.sh |
*.lpsnmedia.net Sectigo RSA Organization Validation Secure Server CA |
2023-01-09 - 2024-01-09 |
a year | crt.sh |
*.kampyle.com GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-08-30 - 2024-09-30 |
a year | crt.sh |
glassboxcdn.com Cloudflare Inc ECC CA-3 |
2023-03-02 - 2024-03-01 |
a year | crt.sh |
*.idp.liveperson.net Sectigo RSA Organization Validation Secure Server CA |
2023-03-30 - 2024-03-29 |
a year | crt.sh |
citizen.glassboxdigital.io Amazon RSA 2048 M03 |
2023-09-19 - 2024-10-16 |
a year | crt.sh |
*.v.liveperson.net Sectigo RSA Organization Validation Secure Server CA |
2023-01-10 - 2024-01-10 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://citizenlogin.c1.is/login.php
Frame ID: B2041576C69E5980EAED58CA6286FB18
Requests: 50 HTTP requests in this frame
Frame:
https://lpcdn.lpsnmedia.net/le_secure_storage/3.24.0.0-release_5105/storage.secure.min.html?loc=https%3A%2F%2Fcitizenlogin.c1.is&site=89632304&env=prod&isCrossDomain=true&accdn=accdn.lpsnmedia.net
Frame ID: 037A6FB1BB58F069A0EF62A3BDA55036
Requests: 2 HTTP requests in this frame
Frame:
https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1701457736881&loc=https%3A%2F%2Fcitizenlogin.c1.is
Frame ID: BA36586A5F769A720F3FC43F84631586
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/a63ad66c-d5e6-45bc-b9e3-da4ef385d14f.png)
Page Title
Online Login | CitizensDetected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/AppDynamics.png)
Detected patterns
- adrum
![](/vendor/wappa/icons/ensighten.png)
Detected patterns
- //nexus\.ensighten\.com/
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Resource Center
Search URL Search Domain Scan URL
Title: Check out everything it can do and see information on how to get it.
Search URL Search Domain Scan URL
Title: Cancel
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
54 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
citizenlogin.c1.is/ |
26 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bootstrap.js
nexus.ensighten.com/citizensbank/olbprod/ |
60 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pm_fp.js
citizenlogin.c1.is/efs/efs/jsp-ns/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui-1.10.3.custom.min.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ |
19 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ |
61 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flows.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad-containers.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-2.6.2.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
15 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plugins.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
199 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
19 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
placeholders.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7c3ed55c
www4.citizensbankonline.com/akam/11/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tealeaf.js
www3.citizensbankonline.com/efs/efs/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CTZ_Green-01.png
www3.citizensbankonline.com/efs/hhf/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizensHeaderFooter-citizensns42588.js
citizenlogin.c1.is/efs/hhf/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
930e113327rn2365aa3b7b98b0447e8d
citizenlogin.c1.is/content/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.js
citizenlogin.c1.is/efs/efs/jsp-ns/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serverComponent.php
nexus.ensighten.com/citizensbank/olbprod/ |
304 B 637 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
lptag.liveperson.net/tag/ |
26 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizen_roman.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/ |
31 KB 32 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
90 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-secure.png
www3.citizensbankonline.com/efs/efs/grafx/ |
292 B 673 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flows-tooltip.png
www3.citizensbankonline.com/efs/efs/grafx/ |
364 B 746 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-button-white.png
www3.citizensbankonline.com/efs/efs/grafx/ |
1017 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-down-blue.png
www3.citizensbankonline.com/efs/efs/grafx/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-right-orange.png
www3.citizensbankonline.com/efs/efs/grafx/ |
165 B 545 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citiolb_icons.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/ |
18 KB 18 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizen_extrabold.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/ |
27 KB 28 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizen_book.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/ |
31 KB 31 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
acd2d9049bb548dd9e9347909f72f93b.js
nexus.ensighten.com/citizensbank/olbprod/code/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-latest.js
cdn.appdynamics.com/adrum/ |
118 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
.jsonp
lptag.liveperson.net/lptag/api/account/89632304/configuration/applications/taglets/ |
334 KB 116 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
accdn.lpsnmedia.net/api/account/89632304/configuration/setting/accountproperties/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ui-framework.js
lpcdn.lpsnmedia.net/le_unified_window/10.32.1.0-release_5645/ |
40 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UMSClientAPI.min.js
lpcdn.lpsnmedia.net/le_unified_window/10.32.1.0-release_5645/ |
92 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lpChatV3.min.js
lpcdn.lpsnmedia.net/le_unified_window/10.32.1.0-release_5645/ |
92 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
surveylogicinstance.min.js
lpcdn.lpsnmedia.net/le_unified_window/10.32.1.0-release_5645/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zones
accdn.lpsnmedia.net/api/account/89632304/configuration/le-campaigns/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
desktopEmbedded.js
lpcdn.lpsnmedia.net/le_unified_window/10.32.1.0-release_5645/ |
1 MB 252 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
storage.secure.min.html
lpcdn.lpsnmedia.net/le_secure_storage/3.24.0.0-release_5105/ Frame 037A |
46 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
storage.secure.min.js
lpcdn.lpsnmedia.net/le_secure_storage/3.24.0.0-release_5105/ |
42 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
refererrestrictions
accdn.lpsnmedia.net/api/account/89632304/configuration/domainprotection/ Frame 037A |
817 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
embed.js
nebula-cdn.kampyle.com/wu/356861/onsite/ |
1 KB 964 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
detector-dom.min.js
cdn.glassboxcdn.com/citizen/OLB/p/ |
453 KB 138 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-ext.a57fe9a4dfa0e1d6b2dc001466e4e21d.js
cdn.appdynamics.com/ |
54 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
generic1699892827662.js
nebula-cdn.kampyle.com/us/wu/356861/onsite/ |
850 KB 121 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ |
0 318 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
postmessage.min.html
va.idp.liveperson.net/postmessage/ Frame BA36 |
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cls_report
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/ |
783 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
7ca4e308-0229-4f03-8cc9-48adf5793bba
https://citizenlogin.c1.is/ |
75 B 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
authorize
va.idp.liveperson.net/api/account/89632304/anonymous/ Frame BA36 |
678 B 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
89632304
va.v.liveperson.net/api/js/ |
162 B 1018 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cls_report
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/ |
783 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citizens Bank (Banking)71 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| documentPictureInPicture string| timeStamp string| pageURL string| pageName object| digitalData object| ensBootstraps object| Bootstrapper number| _delay boolean| isProductionEnvironment string| lpAccountNumber object| lpTag object| html5 object| Modernizr function| yepnope function| $ function| jQuery object| CITIZENSOLB object| Placeholders string| bazadebezolkohpepadr object| thebody object| _cf number| adrum-start-time object| adrum-config object| ADRUM function| _typeof function| _extends object| lpTaglogListeners object| eventListenerMap object| proxyless object| lpMTagConfig function| createFrameworkGlobals object| liveperson function| SurveyManager function| _stateChanged object| STORAGE object| proto string| QUESTION_ERROR_TYPE object| __core-js_shared__ object| lpIntlTelInputUtils object| lpIntlTelInputGlobals number| formId function| showSurvey string| key object| KAMPYLE_EMBED object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK object| KAMPYLE_INTEGRATION object| cooladata object| _cls_config object| _detector object| webVitals object| convertize12 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD | Name: _cls_cfgver Value: 27baeec |
|
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD | Name: _cls_v Value: c9e4772b-2f2f-4866-b4d5-795699c10f79 |
|
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD | Name: _cls_s Value: 4fdbf85d-d5df-4344-b795-1845860b97b6:0 |
|
citizenlogin.c1.is/ | Name: mdLogger Value: false |
|
citizenlogin.c1.is/ | Name: kampyle_userid Value: d008-e8df-ca6d-d6ca-bd0a-ba2b-b759-77ad |
|
citizenlogin.c1.is/ | Name: kampyleUserSession Value: 1701457736503 |
|
citizenlogin.c1.is/ | Name: kampyleUserSessionsCount Value: 1 |
|
citizenlogin.c1.is/ | Name: kampyleSessionPageCounter Value: 1 |
|
.c1.is/ | Name: _cls_v Value: c9e4772b-2f2f-4866-b4d5-795699c10f79 |
|
.c1.is/ | Name: _cls_s Value: 4fdbf85d-d5df-4344-b795-1845860b97b6:0 |
|
report.citizen.glassboxdigital.io/ | Name: AWSALBCORS Value: 438l8u8GFhUr/AQrLvLy1bjGfDhZPJQukUgs7bhPXOeME16Ka+eg3U74ImF6IEeIsB1p4GlLsoWg9QIwLOlihs3HN7kYnCxHqeu5UipW65UhqlHnKIueWpGQReJS |
|
.c1.is/ | Name: LPVID Value: QwNGVmMjNiNDIwNzQ2MmVm |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accdn.lpsnmedia.net
cdn.appdynamics.com
cdn.glassboxcdn.com
citizenlogin.c1.is
lpcdn.lpsnmedia.net
lptag.liveperson.net
nebula-cdn.kampyle.com
nexus.ensighten.com
report.citizen.glassboxdigital.io
udc-neb.kampyle.com
va.idp.liveperson.net
va.v.liveperson.net
www3.citizensbankonline.com
www4.citizensbankonline.com
104.18.14.22
13.227.219.115
151.101.65.175
178.249.97.23
178.249.97.99
198.45.114.194
208.89.12.87
208.89.15.170
23.45.102.71
34.120.154.120
35.168.182.7
35.241.45.82
65.9.66.34
0147f47c377f527213ad86617cd97003a1652f09a8297b40c71909a047773f3a
05b53932e9b22dd68cc9509f6a86b15499b6ccf67146818481409c54810facca
0ca2d5d4dece21114294a8783944cdd00a4351935831b27f9a83b8eb543c6438
0e9485cdb6a684713287cb41c6e6c3e26d12280f17349f98402456ff86ec9759
0f356a0d20286b7bf03fabf8d58a2d3b4b5ad698a05067eb0e2a92ff8aa31927
2a0a7ee3ea564db1e157dd2202c20b8092228fea9091f5cd1e83551e170ec277
392d367eebbc2b193466fd5811fbe94771aa77eae9d7f9c1c4ba645a220c4fc5
3e4f5d07904cf355da7bfbca5d4eee18a4c09fc9e6a79df958d0bb1225572983
4a42c97976166feeddc07c860f5fff8f3c43b9784b4ad3681306311caa071982
4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff
56a8532b2a60ca2ae39c213f7e1e65e47834af927e6365444457f22ed12ed79c
57a2dc0af7db36023b2b6c53e01dbd8e716d96174486ad20d68b2549589c5441
66a13cad6c244da4061da65fd2fbf027bf1bb49e21c42f5e7c943a9379f1e7c4
6f949ae118121071bdff55bcf8166a92afc62d62fcc4aa220bdcd4da10ff2fe2
775f219b8a10dce94e3c462c2c051bddbc04245b70258595e1e2c0a821226361
7aaf6df215bb7018439342fe6bcd1058de3e7dfa2c7b4e1176c842b1a8e529ac
7e4e2d5a197aa79950c7ea8640ddd1cc48a8a8548c9098916a64eab3057e6cec
88f04fecfd90d6b29597d23e934ed1c084167766ecbc1bb38fb71e0e786535dc
9130b21609b6374265d7ba982746d6ff332ee107ec831b7c92760df02f4af248
91afb84bded857517d6a7e43932e3d4a43eaf42d1e4d0b77a8bc9c07973e21d2
99373341554ceaade5ea6c81725f1cd4d05e906621a15797d99d01343ae551f8
9bc49e2d077ff3ee73f6c2ea5275a53bd78c3815f98f67ff06a1e48b43f28d9a
9f837a298161cf85d750b8a60b01d21ad05cd27d819e559c3c195cdc1bfcea4d
a598f2acfc8bb234bed22a701d461190170bc572fa4466e71609695dad82a1f4
aa05549bb56b09ce62e330b66cc3edb278c2e8d8994bb1d78da371ba18f43a26
aa084d3968ab19898ebbed807ebc134b622fab78a888e7b36ae8386841636801
b151e0b00168160cb1ab2d58d07a13b36fdb791298c803f150be651ba6dc9e6d
b2009053bfe5f1b4b1d56509b4b6c393752b70545cb7b3d60a7abe2dc6374b67
b23d0629822256b320de68cece2a79525216c20a0b040d4ee0ee6dd216b98115
b769305d18e59ddd6f13c3fb6db4f90a15770b3717aaddbadb6e543918178bc8
babf6fd29c079790cc4d522f66f21af7c099e981080ddf11b5344b12b904e8a5
bacfd23af9c90b604030b1fde7b8b7ca90f47c6902724d666a99e02ea36d682c
bbb90a8f240e6dbbda1d3da534f8848f256e623ed470d045e1d86a465e424d69
bf99a3203217c802888087df8a2c84b92e087829e7e24d38581a57cee763923b
c8b1f6c22756521c86a5b0053b8565b49436f7fa19d1bb7cdf00a7808df28d42
c8cd0b0d514cecdaf4e7214325a70bba9bae301e156265bd0d880f9065d1d183
c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46
cad0f4b1f9bfa3f4ef94d78c20ae16464bda0fb3902fd7689e26a2904cea29d9
cf25ec18f223f4c51ce1128a42e644cdc2244d88f89d1a51440d9dbe51f4efe8
db5d203d8dd9be14652c38304f812c6ee5c0a8652f1a027d73e88e6ee345969b
dfc042f7ff75f3c2f916bcfbff48c82834bab07b698a2c564906ca073f8286b2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edd419f7d0e1e91191f0d6e366295664490499d5a026cab8b9821363daa86b35
edde5f9519d05ce9c276faa8df865f8ab1eb0e9696bd6c1b0bbd5d174fd8dc1a
efb839bd16a9762619cdbc70de6bc578182a08364712c884052a6f76b1098ebe
f8540b077628748c708e54122c6ac623fb8f2f490ae1fd6f99ef2ccc97a6ac9b
ff327ec2a6dbd3fc76ceecf59e472d5d2f43c94dce851ced740abe5f75bb832e