rbfc.163-5-64-31.cprapid.com Open in urlscan Pro
163.5.64.31  Malicious Activity! Public Scan

Submitted URL: https://cwmk.mx/auth-rbfcu
Effective URL: https://rbfc.163-5-64-31.cprapid.com/
Submission: On December 29 via api from US — Scanned from US

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 19 HTTP transactions. The main IP is 163.5.64.31, located in France and belongs to VIRTUO, CA. The main domain is rbfc.163-5-64-31.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 18th 2023. Valid for: 3 months.
This is the only time rbfc.163-5-64-31.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Randolph Brooks Federal Credit Union (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 162.241.183.107 19871 (NETWORK-S...)
12 163.5.64.31 399486 (VIRTUO)
2 13.32.208.104 16509 (AMAZON-02)
3 142.251.40.138 15169 (GOOGLE)
1 142.251.40.131 15169 (GOOGLE)
1 54.186.205.138 16509 (AMAZON-02)
19 5
Apex Domain
Subdomains
Transfer
12 cprapid.com
rbfc.163-5-64-31.cprapid.com
557 KB
3 googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 357
122 KB
2 appdynamics.com
cdn.appdynamics.com — Cisco Umbrella Rank: 4227
64 KB
1 eum-appdynamics.com
col.eum-appdynamics.com — Cisco Umbrella Rank: 3356
778 B
1 gstatic.com
fonts.gstatic.com
16 KB
1 cwmk.mx
cwmk.mx
258 B
19 6
Domain Requested by
12 rbfc.163-5-64-31.cprapid.com rbfc.163-5-64-31.cprapid.com
3 maps.googleapis.com rbfc.163-5-64-31.cprapid.com
cdn.appdynamics.com
2 cdn.appdynamics.com rbfc.163-5-64-31.cprapid.com
cdn.appdynamics.com
1 col.eum-appdynamics.com cdn.appdynamics.com
1 fonts.gstatic.com rbfc.163-5-64-31.cprapid.com
1 cwmk.mx 1 redirects
19 6

This site contains no links.

Subject Issuer Validity Valid
rbfc.163-5-64-31.cprapid.com
cPanel, Inc. Certification Authority
2023-12-18 -
2024-03-17
3 months crt.sh
*.appdynamics.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-21 -
2024-07-21
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
*.eum-appdynamics.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-14 -
2024-07-14
a year crt.sh

This page contains 1 frames:

Primary Page: https://rbfc.163-5-64-31.cprapid.com/
Frame ID: B59D54FD40370C555A7D472CF9543CEE
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

RBFCU - Sign In

Page URL History Show full URLs

  1. https://cwmk.mx/auth-rbfcu HTTP 301
    https://rbfc.163-5-64-31.cprapid.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • adrum

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

759 kB
Transfer

1131 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cwmk.mx/auth-rbfcu HTTP 301
    https://rbfc.163-5-64-31.cprapid.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
rbfc.163-5-64-31.cprapid.com/
Redirect Chain
  • https://cwmk.mx/auth-rbfcu
  • https://rbfc.163-5-64-31.cprapid.com/
50 KB
50 KB
Document
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
5ced5da91fe78b826d61a0b4f7eba6398ee8e69f6a75bdf410500406e62b3cd7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Fri, 29 Dec 2023 21:33:29 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Length
245
Content-Type
text/html; charset=iso-8859-1
Date
Fri, 29 Dec 2023 21:33:30 GMT
Keep-Alive
timeout=5, max=100
Location
https://rbfc.163-5-64-31.cprapid.com/
Server
Apache
icon
rbfc.163-5-64-31.cprapid.com/assets/css/
569 B
785 B
Stylesheet
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/css/icon
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
786f8e86896c85d5941a05d0519c32b261947a8c229f5581f308595381b7448e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:48 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
569
css
rbfc.163-5-64-31.cprapid.com/assets/css/
25 KB
25 KB
Stylesheet
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/css/css
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
72903641d7b2e58f389891e9eadc41d3523618cf68c3b50f663a3926bc1b951a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:48 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
25392
css(1)
rbfc.163-5-64-31.cprapid.com/assets/css/
6 KB
6 KB
Stylesheet
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/css/css(1)
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
da69cac52f26b084e470c8a96c9d8fdfdca729849b2ef290ce55b522c9a3aa73

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:52 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
6014
css(2)
rbfc.163-5-64-31.cprapid.com/assets/css/
10 KB
11 KB
Stylesheet
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/css/css(2)
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
de9dd00383d82fc9c29d88a6718c69b6796228809256b07d8aae6a7b01d4e057

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:54 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
10544
chat-bundle.css
rbfc.163-5-64-31.cprapid.com/assets/css/
532 B
773 B
Stylesheet
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/css/chat-bundle.css
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
13742c8e5a90fd4af3f1020bcc68de5cdc660022fdb2ba254e65e266fa4138f0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:52 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
532
styles.f1c83d5267fd564adeae.css
rbfc.163-5-64-31.cprapid.com/assets/css/
190 KB
190 KB
Stylesheet
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/css/styles.f1c83d5267fd564adeae.css
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
ed056bef248a663553dddb5fc5d4f650de78970145fdc37fdf40cb1b615404fb

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:52 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
194263
js
rbfc.163-5-64-31.cprapid.com/assets/js/
163 KB
163 KB
Script
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/js/js
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
d747d8d6c248f8e45368a8ce6cdc2126fb558b5df0f3c5f10ece599082bfcd54

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:50 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
167104
adrum-latest.js
cdn.appdynamics.com/adrum/
118 KB
43 KB
Script
General
Full URL
https://cdn.appdynamics.com/adrum/adrum-latest.js
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.208.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-208-104.iad66.r.cloudfront.net
Software
nginx/1.16.1 /
Resource Hash
9130b21609b6374265d7ba982746d6ff332ee107ec831b7c92760df02f4af248

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 22:44:32 GMT
content-encoding
gzip
via
1.1 3a7c02063c5f3d8ad13db0f8e016ccc2.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD66-C1
age
2414938
x-cache
Hit from cloudfront
last-modified
Tue, 21 Nov 2023 16:11:08 GMT
server
nginx/1.16.1
etag
W/"655cd69c-1d6a7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2678400, s-max-age=14400
timing-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RsgaSrMznTfni3R-oPVrQPu8Qc_iT2TA9NFWx4n0JQGe_rI80dMckA==
rbfcu-logo.svg
rbfc.163-5-64-31.cprapid.com/assets/img/
5 KB
5 KB
Image
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/img/rbfcu-logo.svg
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:56 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
5383
NCUA-logo-gray.svg
rbfc.163-5-64-31.cprapid.com/assets/img/
102 KB
102 KB
Image
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/img/NCUA-logo-gray.svg
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:56 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
104580
EHL-logo-gray.svg
rbfc.163-5-64-31.cprapid.com/assets/img/
2 KB
2 KB
Image
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/assets/img/EHL-logo-gray.svg
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Last-Modified
Mon, 16 May 2022 11:22:56 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1613
gen_204
maps.googleapis.com/maps/api/mapsjs/
3 B
366 B
XHR
General
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/assets/js/js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s80-in-f10.1e100.net
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 29 Dec 2023 21:33:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://rbfc.163-5-64-31.cprapid.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
white-phone-header.4a066fd87a48426d8cf5.svg
rbfc.163-5-64-31.cprapid.com/online/
315 B
315 B
Image
General
Full URL
https://rbfc.163-5-64-31.cprapid.com/online/white-phone-header.4a066fd87a48426d8cf5.svg
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
163.5.64.31 , France, ASN399486 (VIRTUO, CA),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 29 Dec 2023 21:33:30 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: rbfc.163-5-64-31.cprapid.com
URL: https://rbfc.163-5-64-31.cprapid.com/assets/css/css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s80-in-f3.1e100.net
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://rbfc.163-5-64-31.cprapid.com/
Origin
https://rbfc.163-5-64-31.cprapid.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 28 Dec 2023 16:45:20 GMT
x-content-type-options
nosniff
age
103691
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Dec 2024 16:45:20 GMT
adrum-ext.a57fe9a4dfa0e1d6b2dc001466e4e21d.js
cdn.appdynamics.com/
54 KB
21 KB
Script
General
Full URL
https://cdn.appdynamics.com/adrum-ext.a57fe9a4dfa0e1d6b2dc001466e4e21d.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.208.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-208-104.iad66.r.cloudfront.net
Software
nginx/1.16.1 /
Resource Hash
edde5f9519d05ce9c276faa8df865f8ab1eb0e9696bd6c1b0bbd5d174fd8dc1a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 22 Dec 2023 16:14:10 GMT
content-encoding
gzip
via
1.1 3a7c02063c5f3d8ad13db0f8e016ccc2.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD66-C1
age
623961
x-cache
Hit from cloudfront
last-modified
Tue, 21 Nov 2023 16:11:07 GMT
server
nginx/1.16.1
etag
W/"655cd69b-d667"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2678400, s-max-age=14400
timing-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_dGTIbrdjX8bviYi6K7ANhGNfWppgeal-ARy4nR6zgHii-vYyyCSnQ==
adrum
col.eum-appdynamics.com/eumcollector/beacons/browser/v1/APP_KEY_NOT_SET/
0
778 B
XHR
General
Full URL
https://col.eum-appdynamics.com/eumcollector/beacons/browser/v1/APP_KEY_NOT_SET/adrum
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum-ext.a57fe9a4dfa0e1d6b2dc001466e4e21d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.186.205.138 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-186-205-138.us-west-2.compute.amazonaws.com
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536010; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://rbfc.163-5-64-31.cprapid.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Fri, 29 Dec 2023 21:33:34 GMT
strict-transport-security
max-age=31536010; includeSubDomains
x-content-type-options
nosniff
server
envoy
vary
*
content-type
text/html
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
x-envoy-upstream-service-time
0
access-control-allow-headers
origin, content-type, accept
expires
0
common.js
maps.googleapis.com/maps-api-v3/api/js/48/12/
82 KB
30 KB
Script
General
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/48/12/common.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s80-in-f10.1e100.net
Software
sffe /
Resource Hash
e32760cb827cf8c5d7046e4cb527aad90cbaaab51b072e4112722c0cbbd11afa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 26 Dec 2023 14:01:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
286320
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30477
x-xss-protection
0
last-modified
Tue, 03 May 2022 20:33:05 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 25 Dec 2024 14:01:35 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/48/12/
308 KB
92 KB
Script
General
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/48/12/util.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s80-in-f10.1e100.net
Software
sffe /
Resource Hash
5b0c26ba901c761c395e560e8ef692337b740ae392e99cf8db7f848b4a3c3eb1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rbfc.163-5-64-31.cprapid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 26 Dec 2023 19:24:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
266950
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
93817
x-xss-protection
0
last-modified
Tue, 03 May 2022 20:33:05 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 25 Dec 2024 19:24:25 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Randolph Brooks Federal Credit Union (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| google object| module$exports$mapsapi$util$event object| module$contents$mapsapi$overlay$overlayView_OverlayView object| ADRUM number| adrum-start-time

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://rbfc.163-5-64-31.cprapid.com/online/white-phone-header.4a066fd87a48426d8cf5.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.appdynamics.com
col.eum-appdynamics.com
cwmk.mx
fonts.gstatic.com
maps.googleapis.com
rbfc.163-5-64-31.cprapid.com
13.32.208.104
142.251.40.131
142.251.40.138
162.241.183.107
163.5.64.31
54.186.205.138
09092e11153b90955b14c6dcad28c3e2902b035f6b12ac85e24a693e5c97c884
13742c8e5a90fd4af3f1020bcc68de5cdc660022fdb2ba254e65e266fa4138f0
3dff3ca4b7e7bdeb6a9ee2c92c7141a270ab5f2373304299a99339ef96454759
5b0c26ba901c761c395e560e8ef692337b740ae392e99cf8db7f848b4a3c3eb1
5ced5da91fe78b826d61a0b4f7eba6398ee8e69f6a75bdf410500406e62b3cd7
72903641d7b2e58f389891e9eadc41d3523618cf68c3b50f663a3926bc1b951a
786f8e86896c85d5941a05d0519c32b261947a8c229f5581f308595381b7448e
8113eb956366da6d18ed13faa5cc8e9a459c09cdcf41c2619c80828d4ac2b152
9130b21609b6374265d7ba982746d6ff332ee107ec831b7c92760df02f4af248
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d747d8d6c248f8e45368a8ce6cdc2126fb558b5df0f3c5f10ece599082bfcd54
da69cac52f26b084e470c8a96c9d8fdfdca729849b2ef290ce55b522c9a3aa73
de9dd00383d82fc9c29d88a6718c69b6796228809256b07d8aae6a7b01d4e057
e32760cb827cf8c5d7046e4cb527aad90cbaaab51b072e4112722c0cbbd11afa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed056bef248a663553dddb5fc5d4f650de78970145fdc37fdf40cb1b615404fb
edde5f9519d05ce9c276faa8df865f8ab1eb0e9696bd6c1b0bbd5d174fd8dc1a