back-inter-refund.com
Open in
urlscan Pro
173.236.158.59
Malicious Activity!
Public Scan
Submission: On May 10 via automatic, source openphish
Summary
This is the only time back-inter-refund.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: RBC (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 173.236.158.59 173.236.158.59 | 26347 (DREAMHOST-AS) (DREAMHOST-AS - New Dream Network) | |
16 | 1 |
ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: apache2-udder.byrch.dreamhost.com
back-inter-refund.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
back-inter-refund.com
back-inter-refund.com |
54 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
16 | back-inter-refund.com |
back-inter-refund.com
|
16 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www1.royalbank.com |
www.rbc.com |
www.rbcroyalbank.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://back-inter-refund.com/rbc2/details.php
Frame ID: 52880C2433ACC01963AB2E86E46BCACE
Requests: 16 HTTP requests in this frame
9 Outgoing links
These are links going to different origins than the main page.
Title: Sign Out
Search URL Search Domain Scan URL
Title: Products & Services
Search URL Search Domain Scan URL
Title: Customer Service
Search URL Search Domain Scan URL
Title: Apply for Products and Services
Search URL Search Domain Scan URL
Title: RBC Online Banking Security Guarantee
Search URL Search Domain Scan URL
Title: RBC Online Banking Security Features
Search URL Search Domain Scan URL
Title: Privacy & Security
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
details.php
back-inter-refund.com/rbc2/ |
41 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common.css
back-inter-refund.com/rbc2/files/ |
91 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
back-inter-refund.com/rbc2/files/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
legacy.css
back-inter-refund.com/rbc2/files/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main01.css
back-inter-refund.com/rbc2/files/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main02.css
back-inter-refund.com/rbc2/files/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tabs.css
back-inter-refund.com/rbc2/files/ |
389 B 506 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rbc_royalbank_en.gif
back-inter-refund.com/rbc2/files/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
secure.gif
back-inter-refund.com/rbc2/files/ |
589 B 857 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screenreaderimage.gif
back-inter-refund.com/rbc2/files/ |
43 B 309 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
highlight-house.gif
back-inter-refund.com/rbc2/files/ |
59 B 325 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btn_continue.gif
back-inter-refund.com/rbc2/files/ |
1020 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newwindow.gif
back-inter-refund.com/rbc2/files/ |
319 B 587 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
print.css
back-inter-refund.com/rbc2/files/ |
1 KB 815 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-legacy.gif
back-inter-refund.com/rbc2/files/ |
15 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
secure-bg.gif
back-inter-refund.com/rbc2/files/ |
5 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: RBC (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| checkform function| checkOnFocusForm function| showThemeNavigation object| ProxyVariableData function| themeNavigationFormAddParameter function| themeBanner_alternateAddParametersSiteMap function| themeBanner_alternateAddParametersClientName function| themeTopNav_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct function| themeTopNav_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct_accountsummary function| themeTopNav_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct_banking function| themeBreadCrumb_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct_banking_pa function| themeBreadCrumb_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct_banking_pa_papdetails function| themeBreadCrumb_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct_banking_pa_papdetails_updateprof function| themeBreadCrumb_alternateAddParameterscom_rbc__3m00_olb_web_portal_pg_myacct_banking_pa_papdetails_updateprof_pvquestion undefined| c3mbp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
back-inter-refund.com/ | Name: PPAGE Value: ChangePVQsA |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
back-inter-refund.com
173.236.158.59
0e3056d6a21d7841c9dfeabbd79bff7a6774019f0bbb31c3b09a041ad3e002aa
1dfdc9c1479cd6f057202c500743628d6f5372fcdb8c296dba1c62f1eb5870a7
4cd1e6a1f377ce80073d52d597f487cfe7d6b3007ab66632c11c05af8242a744
593d555f93d2ab14881453bbf9c80f85b7f318be68393e61f9ea66f053227c1b
5ef09b87e0bd5b854561f66cb2b4dcf13817271e20c6591b7a223d18b69a3d9d
60a22a3e93c410bc31c758f048c0c54e408690cb887f4cafc9db3ae54765f198
6fd91600f77aa05ee1e02f5ab5091377d24e1423d8cd449af3b2ffceafef46e8
711f3d4857e67b5c7167f19a3627c189715683822e4ff3b890b6226666575a45
775bd9df2c430495e3622fefc74b708cdb16b1ea9afbe4f185be00aea9151257
7da651afdd09e54d4cbd4ec8485c00a3e2f857065b67379d65e0aba84671033c
8536a6a63cbeea431a6929ef06fdfd91edcee60876f34bba06cb68e1586d8abc
99f33b091cc50ecf1f5c4fe90f8a3f8e4320dc2eaef376e5743a28cc0cde6dfd
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2d491df3a0bdd20e431c8a352a5b4aacdd05f1be7a3eaaea5144962f7fbf41e
e74218f409ea0ff113fa0b5d281915ca6f769899a97702d555575cafc3ec71a9
fcd69ac86df7eecd7219c4d9b73b938736e64522e03ef115b6e857c9a82f1171