![](/screenshots/f310967c-86bc-4911-b9cc-79acbbbf2322.png)
suncorp-devices.com
Open in
urlscan Pro
104.21.25.240
Malicious Activity!
Public Scan
Effective URL: https://suncorp-devices.com/sc
Submission: On February 17 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 16th 2023. Valid for: a year.
This is the only time suncorp-devices.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Suncorp (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.67.134.235 172.67.134.235 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 10 | 104.21.25.240 104.21.25.240 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 69.16.175.10 69.16.175.10 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
11 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
suncorp-devices.com
2 redirects
suncorp-devices.com |
161 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 699 |
30 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
11 | suncorp-devices.com |
2 redirects
suncorp-devices.com
code.jquery.com |
1 | code.jquery.com |
suncorp-devices.com
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-02-16 - 2024-02-15 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://suncorp-devices.com/sc
Frame ID: 76E4DE268369DEC8721CD7B9BD387524
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/f310967c-86bc-4911-b9cc-79acbbbf2322.png)
Page Title
Suncorp LoginPage URL History Show full URLs
-
http://suncorp-devices.com/
HTTP 301
https://suncorp-devices.com/ HTTP 302
https://suncorp-devices.com/sc Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://suncorp-devices.com/
HTTP 301
https://suncorp-devices.com/ HTTP 302
https://suncorp-devices.com/sc Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
sc
suncorp-devices.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
normalize.css
suncorp-devices.com/assets/sc/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
suncorpnew-uama.css
suncorp-devices.com/assets/sc/ |
900 KB 70 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
actions.js
suncorp-devices.com/assets/js/ |
778 B 763 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Logo-header.svg
suncorp-devices.com/assets/sc/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Icon-lock.svg
suncorp-devices.com/assets/sc/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AtlasGrotesk-Light.woff2
suncorp-devices.com/assets/sc/ |
40 KB 41 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AtlasGrotesk-Medium.woff2
suncorp-devices.com/assets/sc/ |
41 KB 41 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
action
suncorp-devices.com/apis/lr/ |
25 B 516 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST |
active
suncorp-devices.com/apis/lr/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- suncorp-devices.com
- URL
- https://suncorp-devices.com/apis/lr/active
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Suncorp (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery string| lrbank string| lrinfo boolean| continueupdate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
suncorp-devices.com/ | Name: PHPSESSID Value: d08029g2c1l9rgr9rqquu8vhik |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
suncorp-devices.com
suncorp-devices.com
104.21.25.240
172.67.134.235
69.16.175.10
1d8c0d3b12f76437fa553aee3abb2808bd87ecec668ef0bc81c66655b52c59c4
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
44e037ac5f4adb28ae5509dc5e060d3fc953d3ad6c280ec554ce46065248ad5a
4552e8f83ebc6080577342a2b4614fb5f05e7e0d0b20df5cdbe017d848796f7f
566a4677ca79c2fdf23677a2a9c94657396c08a61df282e387cccdf88d966611
5835a08874348f1c21b5eb17bd19b9d4787feaeb008180deca1382cb77ba0851
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
c8c4081a06ec353877cd55f30584ba3aab40fdccb40cd237861b7039dbe945b3
d5e5017486376d628cc29d1b8b9a94ab40c5e17f7ba3ad2ce362ecdf9eecc089
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e