www.capitalon.transmarine.com.pk Open in urlscan Pro
72.18.132.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.capitalon.transmarine.com.pk/
Effective URL:
http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2
Submission: On September 30 via api (September 30th 2021, 1:12:17 am UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 72.18.132.9, located in Denver, United States and belongs to WEHOSTWEBSITES-COM, US. The main domain is www.capitalon.transmarine.com.pk.

This is the only time www.capitalon.transmarine.com.pk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citizens Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 10	72.18.132.9 72.18.132.9	30475 (WEHOSTWEB...) (WEHOSTWEBSITES-COM)
1	142.250.185.193 142.250.185.193	15169 (GOOGLE) (GOOGLE)
9	2

10 72.18.132.9 (Denver, United States) 2 redirects

ASN30475 (WEHOSTWEBSITES-COM, US)
PTR: server90.a2zcreatorz.com

www.capitalon.transmarine.com.pk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f1.1e100.net

my-style-css.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	transmarine.com.pk 2 redirects www.capitalon.transmarine.com.pk	365 KB
1	blogspot.com my-style-css.blogspot.com
9	2

	Domain	Requested by
10	www.capitalon.transmarine.com.pk	2 redirects www.capitalon.transmarine.com.pk
1	my-style-css.blogspot.com	www.capitalon.transmarine.com.pk
9	2

This site contains no links.

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2
Frame ID: 35BC1C76CBB10FF61AEFABD9813147AB
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citizens Banks - login

Page URL History Show full URLs

http://www.capitalon.transmarine.com.pk/ HTTP 302
http://www.capitalon.transmarine.com.pk/5mmi0ogy=/index.php?cmd=_update_account&session=NjI3MjEyODIzODA2OTk2 HTTP 302
http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&sessio... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

11 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

364 kB
Transfer

362 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.capitalon.transmarine.com.pk/ HTTP 302
http://www.capitalon.transmarine.com.pk/5mmi0ogy=/index.php?cmd=_update_account&session=NjI3MjEyODIzODA2OTk2 HTTP 302
http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set login.php Show response www.capitalon.transmarine.com.pk/5mmi0ogy=/ Redirect Chain http://www.capitalon.transmarine.com.pk/ http://www.capitalon.transmarine.com.pk/5mmi0ogy=/index.php?cmd=_update_account&session=NjI3MjEyODIzODA2OTk2 http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2	1 KB 2 KB	1314ms 1314ms	Document text/html	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `a98ba7932567d77e66ee8ca6570de4e559f8e2cfcfd78d2917593272af7e72a4` Request headers Host www.capitalon.transmarine.com.pk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Thu, 30 Sep 2021 01:12:11 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf; path=/ Keep-Alive timeout=5, max=98 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Thu, 30 Sep 2021 01:12:11 GMT Server Apache location login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Content-Length 0 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style.css www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	2 KB 2 KB	136ms 135ms	Stylesheet text/css	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/style.css Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `939ce6c74965d5556761a914165a986772d9fe35c8b56993ceb560b75158615d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Last-Modified Thu, 30 Sep 2021 01:12:11 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2000
GET H2	404	/ my-style-css.blogspot.com/	0 0	312ms 205ms	Stylesheet text/html	142.250.185.193 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://my-style-css.blogspot.com/?style.css Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s52-in-f1.1e100.net Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H/1.1	200 OK	q.js Show response www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	286 KB 286 KB	137ms 137ms	Script application/javascript	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/q.js Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept / Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Last-Modified Thu, 30 Sep 2021 01:12:11 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 293072
GET H/1.1	200 OK	v.js Show response www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	49 KB 49 KB	268ms 134ms	Script application/javascript	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/v.js Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `ca1415a994b05655d3a8fb4bbae4e38cfe62cfb17ecc559d1915f60bf39deb92` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept / Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Last-Modified Thu, 30 Sep 2021 01:12:11 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 50280
GET H/1.1	200 OK	m.js Show response www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	18 KB 18 KB	268ms 134ms	Script application/javascript	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/m.js Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept / Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Last-Modified Thu, 30 Sep 2021 01:12:11 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18430
GET H/1.1	200 OK	CTZ_Green-01.png www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	5 KB 5 KB	134ms 134ms	Image image/png	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Show image Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/CTZ_Green-01.png Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `bf99a3203217c802888087df8a2c84b92e087829e7e24d38581a57cee763923b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Last-Modified Thu, 30 Sep 2021 01:12:11 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5277
GET H/1.1	200 OK	lock.png www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	292 B 533 B	134ms 134ms	Image image/png	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Show image Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/lock.png Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Last-Modified Thu, 30 Sep 2021 01:12:11 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 292
GET H/1.1	404 Not Found	call.png www.capitalon.transmarine.com.pk/5mmi0ogy=/res/	315 B 315 B	137ms 137ms	Image text/html	72.18.132.9 WEHOSTWEBSITES-COM
General Check archive.org Show headers Download Go to Show image Full URL http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/call.png Requested by Host: www.capitalon.transmarine.com.pk URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Protocol HTTP/1.1 Server 72.18.132.9 Denver, United States, ASN30475 (WEHOSTWEBSITES-COM, US), Reverse DNS server90.a2zcreatorz.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.capitalon.transmarine.com.pk Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer* http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 Cookie PHPSESSID=754c813b3869ab6cf046e85f594c80cf Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://www.capitalon.transmarine.com.pk/5mmi0ogy=/login.php?cmd=Unlock&Token=d62bd63068dce68725c8e5fc0b4e4f05&session=5246_sssf2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 30 Sep 2021 01:12:13 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citizens Bank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.capitalon.transmarine.com.pk/	1969-12-31 23:59:59	Name: PHPSESSID Value: 754c813b3869ab6cf046e85f594c80cf

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://my-style-css.blogspot.com/?style.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: http://www.capitalon.transmarine.com.pk/5mmi0ogy=/res/call.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

my-style-css.blogspot.com
www.capitalon.transmarine.com.pk
142.250.185.193
72.18.132.9
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
939ce6c74965d5556761a914165a986772d9fe35c8b56993ceb560b75158615d
a98ba7932567d77e66ee8ca6570de4e559f8e2cfcfd78d2917593272af7e72a4
bf99a3203217c802888087df8a2c84b92e087829e7e24d38581a57cee763923b
c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46
ca1415a994b05655d3a8fb4bbae4e38cfe62cfb17ecc559d1915f60bf39deb92
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

www.capitalon.transmarine.com.pk Open in urlscan Pro 72.18.132.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

11 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

364 kBTransfer

362 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

www.capitalon.transmarine.com.pk Open in urlscan Pro
72.18.132.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

11 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

364 kB
Transfer

362 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!