![](/screenshots/aac61eef-6ad3-4b05-890a-cd3787cbbc2c.png)
ribsfcus.zya.me
Open in
urlscan Pro
185.27.134.34
Malicious Activity!
Public Scan
Effective URL: http://ribsfcus.zya.me/?i=2
Submission: On January 12 via api from US — Scanned from US
Summary
This is the only time ribsfcus.zya.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Randolph Brooks Federal Credit Union (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 14 | 185.27.134.34 185.27.134.34 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
2 4 | 2606:4700:303... 2606:4700:3031::ac43:bdc1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 3.161.213.97 3.161.213.97 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:822::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 44.235.22.63 44.235.22.63 | 16509 (AMAZON-02) (AMAZON-02) | |
18 | 5 |
ASN16509 (AMAZON-02, US)
PTR: server-3-161-213-97.yul62.r.cloudfront.net
cdn.appdynamics.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-235-22-63.us-west-2.compute.amazonaws.com
col.eum-appdynamics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
zya.me
2 redirects
ribsfcus.zya.me |
572 KB |
4 |
aeonfree.com
2 redirects
aeonfree.com |
1 KB |
2 |
appdynamics.com
cdn.appdynamics.com — Cisco Umbrella Rank: 4434 |
64 KB |
1 |
eum-appdynamics.com
col.eum-appdynamics.com — Cisco Umbrella Rank: 3544 |
1 KB |
1 |
googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 362 |
356 B |
18 | 5 |
Domain | Requested by | |
---|---|---|
14 | ribsfcus.zya.me |
2 redirects
ribsfcus.zya.me
|
4 | aeonfree.com |
2 redirects
ribsfcus.zya.me
|
2 | cdn.appdynamics.com |
ribsfcus.zya.me
cdn.appdynamics.com |
1 | col.eum-appdynamics.com |
cdn.appdynamics.com
|
1 | maps.googleapis.com |
ribsfcus.zya.me
|
18 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.appdynamics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-06-21 - 2024-07-21 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-12-11 - 2024-03-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://ribsfcus.zya.me/?i=2
Frame ID: 10823079142CDAB157C9257F02019BCE
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/aac61eef-6ad3-4b05-890a-cd3787cbbc2c.png)
Page Title
RBFCU - Sign InPage URL History Show full URLs
- http://ribsfcus.zya.me/?i=1 Page URL
- http://ribsfcus.zya.me/?i=2 Page URL
Detected technologies
![](/vendor/wappa/icons/AppDynamics.png)
Detected patterns
- adrum
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://ribsfcus.zya.me/?i=1 Page URL
- http://ribsfcus.zya.me/?i=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- http://ribsfcus.zya.me/assets/css/chat-bundle.css HTTP 302
- https://aeonfree.com/error/403/ HTTP 301
- https://aeonfree.com/error/403
- http://ribsfcus.zya.me/online/white-phone-header.4a066fd87a48426d8cf5.svg HTTP 302
- https://aeonfree.com/error/404/ HTTP 301
- https://aeonfree.com/error/404
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
ribsfcus.zya.me/ |
826 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aes.js
ribsfcus.zya.me/ |
13 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
ribsfcus.zya.me/ |
50 KB 50 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon
ribsfcus.zya.me/assets/css/ |
569 B 887 B |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
ribsfcus.zya.me/assets/css/ |
25 KB 25 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css(1)
ribsfcus.zya.me/assets/css/ |
6 KB 6 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css(2)
ribsfcus.zya.me/assets/css/ |
10 KB 11 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
403
aeonfree.com/error/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.f1c83d5267fd564adeae.css
ribsfcus.zya.me/assets/css/ |
190 KB 190 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js
ribsfcus.zya.me/assets/js/ |
163 KB 163 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-latest.js
cdn.appdynamics.com/adrum/ |
118 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rbfcu-logo.svg
ribsfcus.zya.me/assets/img/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NCUA-logo-gray.svg
ribsfcus.zya.me/assets/img/ |
102 KB 102 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EHL-logo-gray.svg
ribsfcus.zya.me/assets/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gen_204
maps.googleapis.com/maps/api/mapsjs/ |
3 B 356 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
404
aeonfree.com/error/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adrum-ext.a57fe9a4dfa0e1d6b2dc001466e4e21d.js
cdn.appdynamics.com/ |
54 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
adrum
col.eum-appdynamics.com/eumcollector/beacons/browser/v1/APP_KEY_NOT_SET/ |
0 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Randolph Brooks Federal Credit Union (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| google object| module$exports$mapsapi$util$event object| module$contents$mapsapi$overlay$overlayView_OverlayView object| ADRUM number| adrum-start-time1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ribsfcus.zya.me/ | Name: __test Value: 7bc57184efb0e076e0badcc229098af1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aeonfree.com
cdn.appdynamics.com
col.eum-appdynamics.com
maps.googleapis.com
ribsfcus.zya.me
185.27.134.34
2606:4700:3031::ac43:bdc1
2607:f8b0:4006:822::200a
3.161.213.97
44.235.22.63
09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884
111c7a623cf837c4fe0ac05153eaf03fea70bbbee929220640e8e8c59d144303
3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759
5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96
72903641d7b2e58f389891e9eadc41d3523618cf68c3b50f663a3926bc1b951a
786f8e86896c85d5941a05d0519c32b261947a8c229f5581f308595381b7448e
78d5aad81c80469c7ddc639d370257762cdb98dc5c68343c8d3e90112acdfb08
8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152
9130b21609b6374265d7ba982746d6ff332ee107ec831b7c92760df02f4af248
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d747d8d6c248f8e45368a8ce6cdc2126fb558b5df0f3c5f10ece599082bfcd54
da69cac52f26b084e470c8a96c9d8fdfdca729849b2ef290ce55b522c9a3aa73
de9dd00383d82fc9c29d88a6718c69b6796228809256b07d8aae6a7b01d4e057
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed056bef248a663553dddb5fc5d4f650de78970145fdc37fdf40cb1b615404fb
edde5f9519d05ce9c276faa8df865f8ab1eb0e9696bd6c1b0bbd5d174fd8dc1a