vortega8.homeip.net Open in urlscan Pro
210.16.103.226 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Submission: On September 23 via manual (September 23rd 2019, 4:11:50 am UTC) from US

Summary HTTP 16 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 210.16.103.226, located in India and belongs to WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN. The main domain is vortega8.homeip.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 16th 2019. Valid for: 3 months.

This is the only time vortega8.homeip.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BB&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
6	210.16.103.226 210.16.103.226	133296 (WEBWERKS-...) (WEBWERKS-AS-IN Web Werks India Pvt. Ltd.)
6	104.111.235.120 104.111.235.120	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
16	4

6 210.16.103.226 (India)

ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN)
PTR: newsharedserver.yourcpanelserver.com

vortega8.homeip.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.111.235.120 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-235-120.deploy.static.akamaitechnologies.com

www.bbt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	bbt.com www.bbt.com	543 KB
6	homeip.net vortega8.homeip.net	668 KB
3	gstatic.com fonts.gstatic.com	33 KB
1	googleapis.com fonts.googleapis.com	976 B
16	4

	Domain	Requested by
6	www.bbt.com	vortega8.homeip.net
6	vortega8.homeip.net	vortega8.homeip.net
3	fonts.gstatic.com	vortega8.homeip.net
1	fonts.googleapis.com	vortega8.homeip.net
16	4

This site contains links to these domains. Also see Links.

Domain
www.bbt.com
bank.bbt.com
itunes.apple.com
play.google.com
thepremierfinancialinstitution.com

Subject Issuer	Validity	Valid
vortega8.homeip.net cPanel, Inc. Certification Authority	`2019-09-16` - `2019-12-15`	3 months	crt.sh
www.bbt.com DigiCert SHA2 Extended Validation Server CA	`2019-04-03` - `2021-02-08`	2 years	crt.sh
*.googleapis.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Frame ID: 4BF1E068064EA3A16F6883610713079A
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1246 kB
Transfer

1254 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bbt.com/
Title: Home

Search URL Search Domain Scan URL

URL: https://bank.bbt.com/bbtpassreset/
Title: Reset your Password

Search URL Search Domain Scan URL

URL: https://bank.bbt.com/bbtpassreset/bbtuseridreset/bbtuserid.do
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://www.bbt.com/education-center/articles/online-security-measures.html
Title: Online security measures

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/u-digital-banking/id995112030?mt=8
Title: Download on the App Store(opens in a new tab)

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.bbt.myfi&hl=en
Title: Get it on Google Play(opens in a new tab)

Search URL Search Domain Scan URL

URL: https://www.bbt.com/online-access/enroll.html
Title: Enroll now

Search URL Search Domain Scan URL

URL: http://thepremierfinancialinstitution.com/
Title: Learn more about the BB&T and SunTrust merger (opens in a new tab)

Search URL Search Domain Scan URL

URL: https://www.bbt.com/education-center/articles/cyber-security-checklist.html
Title: Review our security tips about protecting your personal and financial information from cyber fraud

Search URL Search Domain Scan URL

URL: https://www.bbt.com/about-us/community.html
Title: Watch our community video

Search URL Search Domain Scan URL

URL: https://www.bbt.com/banking/card-design.html
Title: Learn more about designing a debit card

Search URL Search Domain Scan URL

URL: https://www.bbt.com/online-access/mobile-banking.html
Title: Learn more about U by BB&T

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
vortega8.homeip.net/log/app/ 352 KB
352 KB 983ms
136ms Document
text/html 210.16.103.226
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 210.16.103.226 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: newsharedserver.yourcpanelserver.com
Software: Apache /
Resource Hash: 5b0cfba76fcba68ae86ba24d2fd37e61ba405998c9b873bff5f5fce02875b941

Request headers

Host: vortega8.homeip.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Date: Mon, 23 Sep 2019 04:11:32 GMT
Server: Apache
Last-Modified: Sun, 15 Sep 2019 01:58:08 GMT
Accept-Ranges: bytes
Content-Length: 360504
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK style.ACSHASH5544549238c1b7200d42e2debd16e954.css
vortega8.homeip.net/log/app/T-Dox/etc/designs/bbt/bbtcom/ 275 KB
276 KB 374ms
129ms Stylesheet
text/css 210.16.103.226
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://vortega8.homeip.net/log/app/T-Dox/etc/designs/bbt/bbtcom/style.ACSHASH5544549238c1b7200d42e2debd16e954.css
Requested by: Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 210.16.103.226 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: newsharedserver.yourcpanelserver.com
Software: Apache /
Resource Hash: 363ddd9082641e5d6c88f4744ffd41e661c3d100778041a20e38ea7830dee6cb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Sep 2019 04:11:32 GMT
Last-Modified: Fri, 06 Sep 2019 10:44:08 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 281975

GET
H/1.1 200
OK symbols.svg
vortega8.homeip.net/log/app/T-Dox/etc/designs/bbt/bbtcom/icons/svg/ 40 KB
41 KB 379ms
128ms Other
image/svg+xml 210.16.103.226
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://vortega8.homeip.net/log/app/T-Dox/etc/designs/bbt/bbtcom/icons/svg/symbols.svg
Requested by: Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 210.16.103.226 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: newsharedserver.yourcpanelserver.com
Software: Apache /
Resource Hash: f5e25a7e7cbacf0fbd52f698ce5b98a0bc605094ff142507a82b59d49bab8ef4

Request headers

Sec-Fetch-Mode: same-origin
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Sep 2019 04:11:32 GMT
Last-Modified: Fri, 06 Sep 2019 14:27:50 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 41280

GET
H/1.1 404
Not Found shield.svg
vortega8.homeip.net/log/app/T-Dox/etc/designs/bbt/bbtcom/icons/svg/ 0
0 387ms
135ms Other
text/html 210.16.103.226
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://vortega8.homeip.net/log/app/T-Dox/etc/designs/bbt/bbtcom/icons/svg/shield.svg
Requested by: Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 210.16.103.226 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: newsharedserver.yourcpanelserver.com
Software: Apache /
Resource Hash

Request headers

Sec-Fetch-Mode: same-origin
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Sep 2019 04:11:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 9
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found symbols.svg
vortega8.homeip.net/etc/designs/bbt/platform/icons/svg/ 0
0 248ms
130ms Other
text/html 210.16.103.226
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://vortega8.homeip.net/etc/designs/bbt/platform/icons/svg/symbols.svg
Requested by: Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 210.16.103.226 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: newsharedserver.yourcpanelserver.com
Software: Apache /
Resource Hash

Request headers

Sec-Fetch-Mode: same-origin
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Sep 2019 04:11:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK image.jpg
www.bbt.com/content/dam/bbt/promo/banners/homepage/personal/affiliates/2018-06-LI-FacilityNight-desktop.jpg.transform/scale-to-half/ 215 KB
215 KB 1620ms
1565ms Image
image/jpeg 104.111.235.120
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bbt.com/content/dam/bbt/promo/banners/homepage/personal/affiliates/2018-06-LI-FacilityNight-desktop.jpg.transform/scale-to-half/image.jpg

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.235.120 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-235-120.deploy.static.akamaitechnologies.com

Software

Resource Hash

d4846a988edc9e2877a6cf2015b1670578110c19fc75d06db6980e69b087f353

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bbt.com https://.bbt.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' http://*.bbt.com https://*.bbt.com;
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Last-Modified: Wed, 18 Sep 2019 19:03:09 GMT
ETag: W/"35bdd-592d87ce51457"
x-frame-options: SAMEORIGIN
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=62472
Date: Mon, 23 Sep 2019 04:11:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 220125
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK image.jpg
www.bbt.com/content/dam/bbt/bbtcom/landscape/suntrust-merger.jpg.transform/scale-to-half/ 56 KB
57 KB 75ms
22ms Image
image/jpeg 104.111.235.120
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bbt.com/content/dam/bbt/bbtcom/landscape/suntrust-merger.jpg.transform/scale-to-half/image.jpg

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.235.120 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-235-120.deploy.static.akamaitechnologies.com

Software

Resource Hash

5c3367ffbae7bba6538a70d7d234caac9b72513696e22fa44571e4a56430984d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bbt.com https://.bbt.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' http://*.bbt.com https://*.bbt.com;
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Last-Modified: Wed, 18 Sep 2019 16:51:37 GMT
ETag: "e0f8-592d6a6801509"
x-frame-options: SAMEORIGIN
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=36788
Date: Mon, 23 Sep 2019 04:11:32 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 57592
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK image.jpg
www.bbt.com/content/dam/bbt/bbtcom/landscape/education-center/cyber-security-checklist.jpg.transform/scale-to-half/ 57 KB
58 KB 84ms
31ms Image
image/jpeg 104.111.235.120
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bbt.com/content/dam/bbt/bbtcom/landscape/education-center/cyber-security-checklist.jpg.transform/scale-to-half/image.jpg

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.235.120 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-235-120.deploy.static.akamaitechnologies.com

Software

Resource Hash

6e91af936b01a98f59871babb3c8288b0eaeed1c2ad2d394ddd57357ea871fe2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bbt.com https://.bbt.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' http://*.bbt.com https://*.bbt.com;
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Last-Modified: Wed, 18 Sep 2019 16:51:37 GMT
ETag: "e55b-592d6a67cf825"
x-frame-options: SAMEORIGIN
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=37000
Date: Mon, 23 Sep 2019 04:11:32 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 58715
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK image.jpg
www.bbt.com/content/dam/bbt/bbtcom/landscape/shared/about-us/community.jpg.transform/scale-to-half/ 67 KB
68 KB 71ms
18ms Image
image/jpeg 104.111.235.120
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bbt.com/content/dam/bbt/bbtcom/landscape/shared/about-us/community.jpg.transform/scale-to-half/image.jpg

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.235.120 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-235-120.deploy.static.akamaitechnologies.com

Software

Resource Hash

c72deae2dbe8c5aa605fc34a023794ea942fb56a1409cbf6f43922d67ea39375

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bbt.com https://.bbt.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' http://*.bbt.com https://*.bbt.com;
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Last-Modified: Wed, 18 Sep 2019 16:51:37 GMT
ETag: "10d57-592d6a67caded"
x-frame-options: SAMEORIGIN
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=36923
Date: Mon, 23 Sep 2019 04:11:32 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 68951
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK image.jpg
www.bbt.com/content/dam/bbt/bbtcom/landscape/personal/banking/prepaid-cards/prepaid-cards-card-design.jpg.transform/scale-to-half/ 95 KB
96 KB 68ms
16ms Image
image/jpeg 104.111.235.120
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bbt.com/content/dam/bbt/bbtcom/landscape/personal/banking/prepaid-cards/prepaid-cards-card-design.jpg.transform/scale-to-half/image.jpg

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.235.120 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-235-120.deploy.static.akamaitechnologies.com

Software

Resource Hash

cf3e645fd07f65c07092dab9f0493305e6422f160184f942bf6a03b972a4abc7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bbt.com https://.bbt.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' http://*.bbt.com https://*.bbt.com;
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Last-Modified: Wed, 18 Sep 2019 16:51:37 GMT
ETag: "17d94-592d6a681fd54"
x-frame-options: SAMEORIGIN
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=36948
Date: Mon, 23 Sep 2019 04:11:32 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 97684
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK image.jpg
www.bbt.com/content/dam/bbt/bbtcom/landscape/personal/online-access/mobile-banking/mobile-banking-mobile-banking.jpg.transform/scale-to-half/ 49 KB
49 KB 73ms
20ms Image
image/jpeg 104.111.235.120
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bbt.com/content/dam/bbt/bbtcom/landscape/personal/online-access/mobile-banking/mobile-banking-mobile-banking.jpg.transform/scale-to-half/image.jpg

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.235.120 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-235-120.deploy.static.akamaitechnologies.com

Software

Resource Hash

696e389298d57f62e54dfd43d6143f344a0178316f89fa48d96921d23b49c2eb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bbt.com https://.bbt.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' http://*.bbt.com https://*.bbt.com;
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
Last-Modified: Wed, 18 Sep 2019 16:51:37 GMT
ETag: "c2e7-592d6a6822464"
x-frame-options: SAMEORIGIN
p3p: CP="NON CUR OTPi OUR NOR UNI"
Cache-Control: max-age=36432
Date: Mon, 23 Sep 2019 04:11:32 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 49895
x-xss-protection: 1; mode=block

GET
H/1.1 404
Not Found symbols.svg
vortega8.homeip.net/etc/designs/bbt/bbtcom/icons/svg/ 0
0 138ms
133ms Other
text/html 210.16.103.226
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://vortega8.homeip.net/etc/designs/bbt/bbtcom/icons/svg/symbols.svg
Requested by: Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 210.16.103.226 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: newsharedserver.yourcpanelserver.com
Software: Apache /
Resource Hash

Request headers

Sec-Fetch-Mode: same-origin
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 23 Sep 2019 04:11:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 css
fonts.googleapis.com/ 14 KB
976 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:81f::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab|Roboto:300,300i,400,500,500i

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

25235810d655fd9997c37807dd0d2a09da4d53bda34d6601bca84722cba5b7b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 23 Sep 2019 04:11:33 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Mon, 23 Sep 2019 04:11:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
expires: Mon, 23 Sep 2019 04:11:33 GMT

GET
H2 200 BngMUXZYTXPIvIBgJJSb6ufN5qWr4xCC.woff2
fonts.gstatic.com/s/robotoslab/v9/ 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v9/BngMUXZYTXPIvIBgJJSb6ufN5qWr4xCC.woff2

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c68d891f07355e5d0807b4a4f18ac8f16f6e9088277be3134c7efa570022ab2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab|Roboto:300,300i,400,500,500i
Origin: https://vortega8.homeip.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Sep 2019 19:34:53 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:19:23 GMT
server: sffe
age: 1672600
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 11272
x-xss-protection: 0
expires: Wed, 02 Sep 2020 19:34:53 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab|Roboto:300,300i,400,500,500i
Origin: https://vortega8.homeip.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 25 Aug 2019 05:39:08 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:52 GMT
server: sffe
age: 2500345
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 11180
x-xss-protection: 0
expires: Mon, 24 Aug 2020 05:39:08 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: vortega8.homeip.net
URL: https://vortega8.homeip.net/log/app/index.html?_branch_match_id=703581936576443388&utm_medium=marketing

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab|Roboto:300,300i,400,500,500i
Origin: https://vortega8.homeip.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 27 Aug 2019 20:33:18 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 2273895
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 11016
x-xss-protection: 0
expires: Wed, 26 Aug 2020 20:33:18 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BB&T Bank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
vortega8.homeip.net
www.bbt.com
104.111.235.120
210.16.103.226
2a00:1450:4001:81f::200a
2a00:1450:4001:825::2003
25235810d655fd9997c37807dd0d2a09da4d53bda34d6601bca84722cba5b7b1
363ddd9082641e5d6c88f4744ffd41e661c3d100778041a20e38ea7830dee6cb
5b0cfba76fcba68ae86ba24d2fd37e61ba405998c9b873bff5f5fce02875b941
5c3367ffbae7bba6538a70d7d234caac9b72513696e22fa44571e4a56430984d
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
696e389298d57f62e54dfd43d6143f344a0178316f89fa48d96921d23b49c2eb
6e91af936b01a98f59871babb3c8288b0eaeed1c2ad2d394ddd57357ea871fe2
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
c68d891f07355e5d0807b4a4f18ac8f16f6e9088277be3134c7efa570022ab2d
c72deae2dbe8c5aa605fc34a023794ea942fb56a1409cbf6f43922d67ea39375
cf3e645fd07f65c07092dab9f0493305e6422f160184f942bf6a03b972a4abc7
d4846a988edc9e2877a6cf2015b1670578110c19fc75d06db6980e69b087f353
f5e25a7e7cbacf0fbd52f698ce5b98a0bc605094ff142507a82b59d49bab8ef4

vortega8.homeip.net Open in urlscan Pro 210.16.103.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

1246 kBTransfer

1254 kBSize

0 Cookies

12 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

vortega8.homeip.net Open in urlscan Pro
210.16.103.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

1246 kB
Transfer

1254 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!