![](/screenshots/c02b8fe3-0a6c-43bb-8b77-daf39a505e22.png)
sparebnkupdate-rackel193800.codeanyapp.com
Open in
urlscan Pro
198.199.109.95
Malicious Activity!
Public Scan
Effective URL: https://sparebnkupdate-rackel193800.codeanyapp.com/BOC/
Submission: On August 23 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on August 20th 2022. Valid for: 3 months.
This is the only time sparebnkupdate-rackel193800.codeanyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of Cyprus (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
1 11 | 198.199.109.95 198.199.109.95 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 | 81.4.191.110 81.4.191.110 | 6866 (CYTA-NETW...) (CYTA-NETWORK Internet Services) | |
3 | 2404:6800:400... 2404:6800:400a:80e::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 5 |
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com
sparebnkupdate-rackel193800.codeanyapp.com |
ASN6866 (CYTA-NETWORK Internet Services, CY)
PTR: cy1110.bankofcyprus.com
online.bankofcyprus.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
codeanyapp.com
1 redirects
sparebnkupdate-rackel193800.codeanyapp.com |
135 KB |
3 |
gstatic.com
fonts.gstatic.com |
88 KB |
2 |
bankofcyprus.com
online.bankofcyprus.com |
31 KB |
1 |
firebaseapp.com
boc-update.firebaseapp.com |
480 B |
16 | 4 |
Domain | Requested by | |
---|---|---|
11 | sparebnkupdate-rackel193800.codeanyapp.com |
1 redirects
sparebnkupdate-rackel193800.codeanyapp.com
|
3 | fonts.gstatic.com |
sparebnkupdate-rackel193800.codeanyapp.com
|
2 | online.bankofcyprus.com |
sparebnkupdate-rackel193800.codeanyapp.com
|
1 | boc-update.firebaseapp.com | |
16 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
firebaseapp.com GTS CA 1D4 |
2022-06-21 - 2022-09-19 |
3 months | crt.sh |
codeanyapp.com R3 |
2022-08-20 - 2022-11-18 |
3 months | crt.sh |
online.bankofcyprus.com Thawte EV RSA CA 2018 |
2021-12-08 - 2023-01-08 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-01 - 2022-10-24 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://sparebnkupdate-rackel193800.codeanyapp.com/BOC/
Frame ID: E59E7703C5C88A88101C21AF4B441EC3
Requests: 16 HTTP requests in this frame
Frame:
https://sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/nFnN1TlBM3ZiqLQFa06U.html
Frame ID: D59C0A0EB9B520675892286FBC56BD25
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/c02b8fe3-0a6c-43bb-8b77-daf39a505e22.png)
Page Title
Bank Of Cyprus - 1BankPage URL History Show full URLs
- https://boc-update.firebaseapp.com/ Page URL
-
https://sparebnkupdate-rackel193800.codeanyapp.com/BOC
HTTP 301
https://sparebnkupdate-rackel193800.codeanyapp.com/BOC/ Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://boc-update.firebaseapp.com/ Page URL
-
https://sparebnkupdate-rackel193800.codeanyapp.com/BOC
HTTP 301
https://sparebnkupdate-rackel193800.codeanyapp.com/BOC/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
boc-update.firebaseapp.com/ |
156 B 480 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
sparebnkupdate-rackel193800.codeanyapp.com/BOC/ Redirect Chain
|
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RlIVZZZPJpEM5dN.css
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
166 B 329 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
skinning.ecss.faces
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
2 KB 2 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navajo-responsive.css
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
227 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navajo-layout.css
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
411 B 457 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
33 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
12 KB 12 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginSmallBanner-en.jpg
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
67 KB 67 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jHnKmVhR9u9G.gif
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ |
43 B 187 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
online.bankofcyprus.com/EKFoDc/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
desktop.jpg
online.bankofcyprus.com/netteller-web/resources/images/Logo/ |
30 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ |
56 KB 56 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nFnN1TlBM3ZiqLQFa06U.html
sparebnkupdate-rackel193800.codeanyapp.com/BOC/Bank%20Of%20Cyprus%20-%201Bank_files/ Frame D59C |
211 B 381 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of Cyprus (Banking)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation boolean| bLauNCTx0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
boc-update.firebaseapp.com
fonts.gstatic.com
online.bankofcyprus.com
sparebnkupdate-rackel193800.codeanyapp.com
198.199.109.95
2404:6800:400a:80e::2003
2620:0:890::100
81.4.191.110
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
1287b4c6427119cabf899a5ea898f81e831a2742614813a3302f671690b399c2
2431372a0aa89c31a7d26cd47fedd06412147d0070e3f1286693a1d69d53d3bc
2a0973cd8fc200b1e13a821a30e3042a7834c5c4fcf26fea54152cf7f9d69ded
2de673f2d2e5efeb272c71fff3f2df30f06d297a462009e02b0dd0916c3b61e6
345888042448c4f1b1801c015ee867b506fc95d9f1c7ce63d3e540ced554ba61
433d4c8eb83f6fd3e06782a30dc516e3c373ec4dea2cc35af6a2bebd5b62dcfe
5f18709e59f9ce79e82636e952f14a6494aeaf481295006b6769d781236292cc
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6aef9bd67386bdd6d4ed375ae564848cf8ccdb037618d46e9df2397021ba9add
6e73875aa7e3a5a4ecee81775dd39ceff5da17707b5b71a570cd85ac1ed94475
bb068bbb53fec6a4baa5b19f23d603fba94b938f242a5baa129d6af68de2df40
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
dcd03504a87740b0b122e86d169171c5d67b4c567da1a54e8d9470e414b7898e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e18ee3b17ab5418b88299f7a689072146eed25077ec2ec2d776d30780104cb92
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855