![](/screenshots/c9eff3ce-ec7c-4095-9bf6-0e2faa0a0f85.png)
thoughtsofteachersbd.com
Open in
urlscan Pro
194.163.180.80
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On October 22 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 14th 2021. Valid for: 3 months.
This is the only time thoughtsofteachersbd.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citizens Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 194.163.180.80 194.163.180.80 | 51167 (CONTABO) (CONTABO) | |
16 | 184.24.5.179 184.24.5.179 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
17 | 2 |
ASN51167 (CONTABO, DE)
PTR: kepler11b.servergoodlife.com
thoughtsofteachersbd.com |
ASN16625 (AKAMAI-AS, US)
PTR: a184-24-5-179.deploy.static.akamaitechnologies.com
www3.citizensbankonline.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
citizensbankonline.com
www3.citizensbankonline.com |
154 KB |
1 |
thoughtsofteachersbd.com
thoughtsofteachersbd.com |
3 KB |
17 | 2 |
Domain | Requested by | |
---|---|---|
16 | www3.citizensbankonline.com |
thoughtsofteachersbd.com
www3.citizensbankonline.com |
1 | thoughtsofteachersbd.com | |
17 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.citizensbank.com |
www3.citizensbankonline.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
thoughtsofteachersbd.com R3 |
2021-10-14 - 2022-01-12 |
3 months | crt.sh |
citizensbankonline.com Entrust Certification Authority - L1M |
2021-05-18 - 2022-05-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://thoughtsofteachersbd.com/wp-includes/Requests/Exception/Transport/admin/index.html
Frame ID: D7C5FE65819A3A32E20E73A9C82AE69F
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/c9eff3ce-ec7c-4095-9bf6-0e2faa0a0f85.png)
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery-ui.*\.js
- jquery-ui[.-]([\d.]*\d)[^/]*\.js
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Trouble Logging In?
Search URL Search Domain Scan URL
Title: View All Help Topics
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Citizens Bank Online Guarantee?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
thoughtsofteachersbd.com/wp-includes/Requests/Exception/Transport/admin/ |
13 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pm_fp.js
www3.citizensbankonline.com/efs/efs/jsp-ns/ |
24 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui-1.10.1.custom.min.css
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/jquery-ui/css/custom-theme/ |
22 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/jquery-ui/js/ |
90 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.hoverIntent.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
1 KB 852 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui-1.10.1.custom.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/jquery-ui/js/ |
111 KB 31 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
capslock.jquery.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/caps_lock/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles-2013.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hinticon.png
www3.citizensbankonline.com/efs/efs/grafx/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ehl.gif
www3.citizensbankonline.com/efs/efs/grafx/ |
88 B 400 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizens-logo-sm.png
www3.citizensbankonline.com/efs/efs/grafx/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
splitter.png
www3.citizensbankonline.com/efs/efs/grafx/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lock-grn.png
www3.citizensbankonline.com/efs/efs/grafx/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-collapse.png
www3.citizensbankonline.com/efs/efs/grafx/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizen_roman.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/ |
31 KB 32 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
citizen_bold.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/ |
29 KB 29 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citizens Bank (Banking)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster string| SEP string| PAIR function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| FingerPrint function| Hashtable function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| add_deviceprint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| $ function| jQuery function| DP_jQuery_1634907005520 object| theBody function| isNumeric function| needHelp function| isSpecialChar function| validateIE7 function| setFieldState function| hasErrors function| getValidateMessageListCheckSpaces function| getValidateMessageList function| getBasicFieldErrorMessages function| getBasicFieldSuccessMessages function| isIE7 function| isUnsupported function| setupToolTip function| setupNonStickyToolTip function| initPasswordToolTip function| initPasswordCapsLock function| validatePasswordRules function| validateField function| isEmpty function| validateGoodPasswordRules0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
thoughtsofteachersbd.com
www3.citizensbankonline.com
184.24.5.179
194.163.180.80
021698a397aac6d81d6db23a8bebc9ba0d134cb92a09d529bcaf749e10a916a3
089d475a97a845f1fa56d66ce227f9a70170aa893249052a7089c307c614daf1
20638e363fcc5152155f24b281303e17da62da62d24ef5dcf863b184d9a25734
34a0f68c279cbb29c79717498dbe63d577a1f94ae9c57aa886a5af279c56b9be
40cc631b457d31330d5a322e1cd49c50b72f41269791e3654f443c9e8e6c1de8
4493613641e90be06b27035387c1a6a96b7598c7d2f449a2ee187733b688face
5bb2d438470a02799577010a14310fa8ac3ed7ea77ca15435aaaa154e407b3e6
5f5174ecbf3d9d3a7154c20eba9fc818d9a208e4100a0f43a1f948a4331a92cc
5f8037c239f9d2e0896271b362703842ea844b7dfca6068a371f8f39c79da2aa
61ab87df5a701ac0749d98660ebbdca021127991d12c2f79cdd723f8a96ecd5a
74fc4318944ac7fdfd5b1bacf28c7ed8aff21c02b76df7bbd0c88de77acb0c42
7574983a9af6d447856f9965e1d156c0027cead27de40ea7af026da3574fc566
88146e8caa732ee54c82fcb58a0c95d5a0bcd44df238a3ebe91a6cb0ed764c7b
ae571edfb75648a099b4bb67a1b33cf1be1133eac6d74e92a786f0303fc08298
c8b1f6c22756521c86a5b0053b8565b49436f7fa19d1bb7cdf00a7808df28d42
f38ccfb82832d5d520a762b30713c43d178f8e9b6e0f9f51970611f06636d6aa
f94fc49d5ff852c411e3da487bd4f63aed16a07642fd0b1231887e8ac3d9b05f