bankofamericax56.webcindario.com
Open in
urlscan Pro
5.57.226.202
Malicious Activity!
Public Scan
Submission Tags: @ipnigh
Submission: On August 21 via api from GB
Summary
This is the only time bankofamericax56.webcindario.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 5.57.226.202 5.57.226.202 | 29119 (SERVIHOST...) (SERVIHOSTING-AS AireNetworks - StackScale) | |
4 | 2a00:1450:400... 2a00:1450:4001:81b::2002 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2606:4700:20:... 2606:4700:20::6819:ce08 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 52.31.220.219 52.31.220.219 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 2a00:1450:400... 2a00:1450:4001:81a::2002 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::2002 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 3 | 2a00:1450:400... 2a00:1450:4001:80b::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 2 | 2a00:1450:400... 2a00:1450:400c:c00::9c | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 2 | 2a00:1450:400... 2a00:1450:4001:820::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:816::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 89.255.250.53 89.255.250.53 | 60626 (LEASEWEBCDN) (LEASEWEBCDN) | |
18 | 11 |
ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES)
bankofamericax56.webcindario.com |
ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com | |
googleads.g.doubleclick.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
hosting.miarroba.info |
ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-31-220-219.eu-west-1.compute.amazonaws.com
des.smartclip.net |
ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de | |
www.googletagservices.com |
ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com |
ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
doubleclick.net
2 redirects
googleads.g.doubleclick.net stats.g.doubleclick.net |
512 B |
3 |
google-analytics.com
2 redirects
www.google-analytics.com |
18 KB |
3 |
google.com
2 redirects
adservice.google.com www.google.com |
1 KB |
3 |
google.de
adservice.google.de www.google.de |
959 B |
3 |
webcindario.com
bankofamericax56.webcindario.com |
311 KB |
2 |
googlesyndication.com
pagead2.googlesyndication.com |
116 KB |
1 |
sunmediaads.com
img.sunmediaads.com play.sunmediaads.com Failed |
17 KB |
1 |
googletagservices.com
www.googletagservices.com |
28 KB |
1 |
smartclip.net
des.smartclip.net |
503 B |
1 |
googletagmanager.com
www.googletagmanager.com |
20 KB |
1 |
miarroba.info
hosting.miarroba.info |
426 B |
18 | 11 |
Domain | Requested by | |
---|---|---|
3 | www.google-analytics.com |
2 redirects
www.googletagmanager.com
|
3 | bankofamericax56.webcindario.com |
bankofamericax56.webcindario.com
|
2 | www.google.de |
bankofamericax56.webcindario.com
|
2 | www.google.com | 2 redirects |
2 | stats.g.doubleclick.net | 2 redirects |
2 | googleads.g.doubleclick.net |
pagead2.googlesyndication.com
|
2 | pagead2.googlesyndication.com |
bankofamericax56.webcindario.com
pagead2.googlesyndication.com |
1 | img.sunmediaads.com |
bankofamericax56.webcindario.com
|
1 | www.googletagservices.com |
pagead2.googlesyndication.com
|
1 | adservice.google.com |
pagead2.googlesyndication.com
|
1 | adservice.google.de |
pagead2.googlesyndication.com
|
1 | des.smartclip.net |
bankofamericax56.webcindario.com
|
1 | www.googletagmanager.com |
bankofamericax56.webcindario.com
|
1 | hosting.miarroba.info |
bankofamericax56.webcindario.com
|
0 | play.sunmediaads.com Failed |
img.sunmediaads.com
|
18 | 15 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
ssl391079.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-07-02 - 2020-01-08 |
6 months | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2019-07-29 - 2019-10-21 |
3 months | crt.sh |
*.google.com Google Internet Authority G3 |
2019-07-29 - 2019-10-21 |
3 months | crt.sh |
*.g.doubleclick.net Google Internet Authority G3 |
2019-07-29 - 2019-10-21 |
3 months | crt.sh |
www.google.de Google Internet Authority G3 |
2019-07-29 - 2019-10-21 |
3 months | crt.sh |
leadzuin.com Sectigo RSA Domain Validation Secure Server CA |
2019-05-20 - 2020-06-18 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
http://bankofamericax56.webcindario.com/5f5360ae/challengevdl.php?cmd=_account-details&session=818a1a50ca84b76a76cb06b5e493f8fa&dispatch=a6a6c9d1597c695bf840f606ba556d9294766830
Frame ID: 52C37A3F5BED19BE4CE1D7EE33E29F65
Requests: 16 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/html/r20190815/r20190131/zrt_lookup.html
Frame ID: EE85853C6A7ADECE6C9E899F17BDC93D
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1566367401&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=http%3A%2F%2Fbankofamericax56.webcindario.com%2F5f5360ae%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D818a1a50ca84b76a76cb06b5e493f8fa%26dispatch%3Da6a6c9d1597c695bf840f606ba556d9294766830&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1566367401575&bpp=5&bdt=41&fdt=72&idt=73&shv=r20190815&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=3171917402354&frm=20&pv=2&ga_vid=1910374524.1566367402&ga_sid=1566367402&ga_hid=1365020390&ga_fc=0&iag=0&icsg=8864&dssz=12&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=20199335%2C410075105&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=23&ifi=0&uci=a!0&fsb=1&dtd=84
Frame ID: 1D9EBE27CA2B9FD3102717D3CE1E9E39
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Google AdSense (Advertising Networks) Expand
Detected patterns
- script /googlesyndication\.com\//i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- https://www.google-analytics.com/r/collect?v=1&_v=j78&a=1365020390&t=pageview&_s=1&dl=http%3A%2F%2Fbankofamericax56.webcindario.com%2F5f5360ae%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D818a1a50ca84b76a76cb06b5e493f8fa%26dispatch%3Da6a6c9d1597c695bf840f606ba556d9294766830&ul=en-us&de=UTF-8&dt=Bank%20of%20America%20%7C%20Online%20Banking%20%7C%20Account%20%7C%20Overview&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABC~&jid=347705137&gjid=324662445&cid=1910374524.1566367402&tid=UA-597118-7&_gid=1405546042.1566367402&_r=1>m=2wg874T2VG59&z=1960973927 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-597118-7&cid=1910374524.1566367402&jid=347705137&_gid=1405546042.1566367402&gjid=324662445&_v=j78&z=1960973927 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=1910374524.1566367402&jid=347705137&_v=j78&z=1960973927 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=1910374524.1566367402&jid=347705137&_v=j78&z=1960973927&slf_rd=1&random=2557946031
- https://www.google-analytics.com/r/collect?v=1&_v=j78&a=1365020390&t=pageview&_s=1&dl=http%3A%2F%2Fbankofamericax56.webcindario.com%2F5f5360ae%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D818a1a50ca84b76a76cb06b5e493f8fa%26dispatch%3Da6a6c9d1597c695bf840f606ba556d9294766830&ul=en-us&de=UTF-8&dt=Bank%20of%20America%20%7C%20Online%20Banking%20%7C%20Account%20%7C%20Overview&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAAABC~&jid=1103836300&gjid=397290122&cid=1910374524.1566367402&tid=UA-597118-1&_gid=1405546042.1566367402&_r=1>m=2wg874T2VG59&z=1603724409 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-597118-1&cid=1910374524.1566367402&jid=1103836300&_gid=1405546042.1566367402&gjid=397290122&_v=j78&z=1603724409 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-1&cid=1910374524.1566367402&jid=1103836300&_v=j78&z=1603724409 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-1&cid=1910374524.1566367402&jid=1103836300&_v=j78&z=1603724409&slf_rd=1&random=901025279
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
challengevdl.php
bankofamericax56.webcindario.com/5f5360ae/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ |
94 KB 35 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overlay.png
bankofamericax56.webcindario.com/5f5360ae/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
hosting.miarroba.info/ |
0 426 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
51 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ads
des.smartclip.net/ |
20 B 503 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bgimage.png
bankofamericax56.webcindario.com/5f5360ae/ |
296 KB 296 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
109 B 476 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
109 B 476 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190815/r20190131/ |
220 KB 82 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190815/r20190131/ Frame EE85 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 374 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame 1D9E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
osd.js
www.googletagservices.com/activeview/js/current/ |
75 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lz_loader.js
img.sunmediaads.com/ads/ |
58 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
zone.php
play.sunmediaads.com/red/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- play.sunmediaads.com
- URL
- https://play.sunmediaads.com/red/zone.php?code=HEZRL65RXYI2&a=&pubid=&lgid=8518239150.6394867296841749
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)79 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| dataLayer object| adsbygoogle function| validateForm object| s string| t object| google_js_reporting_queue object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state object| google_sa_queue object| google_sl_win function| google_process_slots function| google_spfd object| google_sv_map object| google_t12n_vars object| google_tag_manager string| GoogleAnalyticsObject function| mia_ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| lz_elem number| default_lz_max_time_fallback object| lz_fallback number| lz_time_listener function| lz_getJSON object| pila_ban object| lz_console function| getDebug function| Encode64 function| Decode64 function| strtr function| strlen function| str_pad function| rtrim function| __ParamEncode function| __ParamDecode function| fixtweakboxapp function| lz_loadads function| lz_loadscripts function| lz_loadfill function| lz_loadscr function| lz_callfallback function| lz_script_item function| lz_listener_dummy function| lz_listener_banner function| lz_fallback_banner function| lz_listener_sunmedia function| lz_fallback_sunmedia function| IW_carga number| lz_max_time_fallback function| htmlParser function| oldwrite function| oldwriteln function| IW_load string| lz_zone0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adservice.google.com
adservice.google.de
bankofamericax56.webcindario.com
des.smartclip.net
googleads.g.doubleclick.net
hosting.miarroba.info
img.sunmediaads.com
pagead2.googlesyndication.com
play.sunmediaads.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
play.sunmediaads.com
2606:4700:20::6819:ce08
2a00:1450:4001:80b::200e
2a00:1450:4001:816::2003
2a00:1450:4001:81a::2002
2a00:1450:4001:81a::2008
2a00:1450:4001:81b::2002
2a00:1450:4001:81c::2002
2a00:1450:4001:820::2004
2a00:1450:400c:c00::9c
5.57.226.202
52.31.220.219
89.255.250.53
0039e11bb2b13c460603e6a72e40e0dda96db75623ff22d1e2bf7ff3229def21
03569bb9a48922288c3bab6565ba0ca4c084b030c9fcf1bd928e86161f73381d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05eb13ede58ea97b14fed9ba506bc9a38ce9f80622f354b0643cfdf45551aa91
05ffd01b1385996024984a7f45022479f13954705ef56f6b5d6b79b534309ade
552295b547de8dc2d3453246e24505349cabbc10480121b024920ea94f1afcb3
7285303c6f1bd19a091fb8046d1c43704c3f846461b957fe4198c3e051fce7eb
b5a29578e8871151f568923a5d9317ebe5f49f0014be5ef9443d5d24928d5372
c0231dc4552a7c882eb133f33e133ae4fdd35bb6805b2195c267ba19efc93f4b
cec3748d0c3da4700300d5424aaea375b03550b0ee8b3dd38e242c4022261446
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed736578b79bd4b2af62f3f546a66a5c5448e499ab1fe5e2fe35f7b164e7e511
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629