Report - securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA

Report Overview

Submitted URL
securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
IP
208.109.201.129
ASN
#398101 GO-DADDY-COM-LLC
Submitted
2024-04-24 22:11:06
Access
public
Website Title
Sign in | Scotiabank
Final URL
securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Tags
scotiabank financial phishing
urlquery detections
Phishing - Scotiabank

Detections

urlquery
9
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
securescotia.com	unknown	unknown	No data	No data	5.3 kB	1.5 MB	208.109.201.129
img1.wsimg.com	9893	2008-03-17	2012-06-20	2024-04-24	862 B	22 kB	23.36.79.16
events.api.secureserver.net	125179	1998-03-30	2020-06-23	2024-04-24	2.5 kB	932 B	104.84.152.58
csp.secureserver.net	unknown	1998-03-30	2022-12-18	2024-04-23	2.2 kB	2.3 kB	104.110.14.92

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA	376 B	2024-04-25	2024-04-25
Pretty URL securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA IP 208.109.201.129 ASN #398101 GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-25 00:11:12 Last Seen2024-04-25 00:11:24 Times Seen3 Hash 9cc7000146c27127b33e2e43697c912f c81dab96a895ed847e9a35cc4ba2f32f928c0bce 0a7b2acaac93027a925bcff4571f5f0264f30261d642d09a95f6a31f1fbd2589 Loading...

	img1.wsimg.com/traffic-assets/js/tccl.min.js	106 kB	2024-03-22	2024-05-03
Pretty URL img1.wsimg.com/traffic-assets/js/tccl.min.js IP 23.36.79.16 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-22 17:30:50 Last Seen2024-05-03 19:12:50 Times Seen482 Hash fdf3f3c180ae2aa6864f9c46a83a37a9 59f698af339af479bc5447e5da54778d909c7068 e301943f5f3cb3486ab3f4c75c0315e96891268a76b8663b6a490324e39d1664 Loading...

HTTP Transactions (16)

URL IP Response Size

securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA

208.109.201.129

200 OK

5.4 kB

URL User Request GET HTTP/2
securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (854)
Size
5.4 kB (5397 bytes)
Hash
6d135c9bc6242d0de0569c7df73b2ea6
63e6fc3cc170bc6e4385bc92d00f51f14e227c8a
1ef9086a599fe8d1fd98dad33f864fe4b6cf00ce400a2b4541eee5230d26e68b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-powered-by: PHP/8.1.27
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq; path=/
vary: Accept-Encoding
content-encoding: br
content-length: 5397
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 22:10:41 GMT
server: Apache
X-Firefox-Spdy: h2

img1.wsimg.com/traffic-assets/js/tccl.min.js

23.36.79.16

301 Moved Permanently

0 B

URL GET HTTP/2
img1.wsimg.com/traffic-assets/js/tccl.min.js
IP
23.36.79.16:443
ASN
#20940 Akamai International B.V.

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.wsimg.com
FingerprintB7:FF:50:92:4F:A1:64:14:99:A1:DE:DB:55:C9:FA:92:78:6B:89:DD
ValidityTue, 19 Sep 2023 21:06:14 GMT - Sun, 20 Oct 2024 21:06:14 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /traffic-assets/js/tccl.min.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-length: 0
location: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
cache-control: max-age=31536000
expires: Thu, 24 Apr 2025 22:10:42 GMT
date: Wed, 24 Apr 2024 22:10:42 GMT
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2

img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

23.36.79.16

200 OK

20 kB

URL GET HTTP/2
img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
IP
23.36.79.16:443
ASN
#20940 Akamai International B.V.

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.wsimg.com
FingerprintB7:FF:50:92:4F:A1:64:14:99:A1:DE:DB:55:C9:FA:92:78:6B:89:DD
ValidityTue, 19 Sep 2023 21:06:14 GMT - Sun, 20 Oct 2024 21:06:14 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
20 kB (20488 bytes)
Hash
fdf3f3c180ae2aa6864f9c46a83a37a9
59f698af339af479bc5447e5da54778d909c7068
e301943f5f3cb3486ab3f4c75c0315e96891268a76b8663b6a490324e39d1664

HTTP Headers

GET /signals/js/clients/scc-c2/scc-c2.min.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://securescotia.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-amz-id-2: zSfZtamdtBiCmRf7q6I0dc5TXg6SYAMwxO2Fn0cVkxc75aNa94ehodGTsMhV1dFuGdVHTiRr5UmxBYR/ArT8Jg==
x-amz-request-id: E0CSM1KGY3NCQ66T
last-modified: Fri, 22 Mar 2024 13:06:20 GMT
etag: "fdf3f3c180ae2aa6864f9c46a83a37a9"
x-amz-server-side-encryption: AES256
x-amz-meta-version: 0.2.5
x-amz-version-id: NUbpk_ypfZoRQFFJE7rB4qpj7fMsB7r1
accept-ranges: bytes
content-type: text/javascript
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=1800
expires: Wed, 24 Apr 2024 22:40:42 GMT
date: Wed, 24 Apr 2024 22:10:42 GMT
content-length: 20488
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2

securescotia.com/sbca_assetz/css/a.css

208.109.201.129

200 OK

48 kB

URL GET HTTP/2
securescotia.com/sbca_assetz/css/a.css
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
Unicode text, UTF-8 text, with very long lines (9535), with CRLF line terminators
Size
48 kB (48482 bytes)
Hash
cef6a2c1190351d4ded88f51dd695ee6
2c8afbb978ce8153eb5b0883f26e4c0ca7383365
252de6e8b2600cefe922cc7f5b5f538e9107ec498d49f80401aa1929289beec6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/css/a.css HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 06:15:12 GMT
etag: "6869479-1b422-616bd7a045c00-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 48482
content-type: text/css
date: Wed, 24 Apr 2024 22:10:42 GMT
server: Apache
X-Firefox-Spdy: h2

securescotia.com/sbca_assetz/img/7c428f63a00e5bd025fa159e8c94389f.svg

208.109.201.129

200 OK

308 B

URL GET HTTP/2
securescotia.com/sbca_assetz/img/7c428f63a00e5bd025fa159e8c94389f.svg
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
SVG Scalable Vector Graphics image
Size
308 B (308 bytes)
Hash
7c428f63a00e5bd025fa159e8c94389f
edb555549cbd96f27715260a7afee8e17296acc7
51bf40e3535dee036bec3df6d4b279b4373fb22cdd40632535932d6999f7e37e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/img/7c428f63a00e5bd025fa159e8c94389f.svg HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 05:11:46 GMT
etag: "6869484-219-616bc97296880-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 308
content-type: image/svg+xml
date: Wed, 24 Apr 2024 22:10:42 GMT
server: Apache
X-Firefox-Spdy: h2

securescotia.com/sbca_assetz/fonts/8fd30bd010d9e2c7677ec339685f958b.woff

208.109.201.129

200 OK

31 kB

URL GET HTTP/2
securescotia.com/sbca_assetz/fonts/8fd30bd010d9e2c7677ec339685f958b.woff
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
Web Open Font Format, TrueType, length 30656, version 1.6554
Size
31 kB (30656 bytes)
Hash
8fd30bd010d9e2c7677ec339685f958b
52f45de0f527644770f4ca9b9435d593a2359662
5f45b253b0621b40b352b1ec52c4b2066bca8e71c5ac54d922459fc8109d9366

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/fonts/8fd30bd010d9e2c7677ec339685f958b.woff HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/sbca_assetz/css/styles.42cc70d9d70c69cf625e.css
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 06:32:40 GMT
etag: "686947f-77c0-616bdb87b9200"
accept-ranges: bytes
content-length: 30656
vary: Accept-Encoding
content-type: font/woff
date: Wed, 24 Apr 2024 22:10:42 GMT
server: Apache
X-Firefox-Spdy: h2

securescotia.com/sbca_assetz/fonts/00cecde981e3ef7491eba946f4b95fe0.woff

208.109.201.129

200 OK

32 kB

URL GET HTTP/2
securescotia.com/sbca_assetz/fonts/00cecde981e3ef7491eba946f4b95fe0.woff
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
Web Open Font Format, TrueType, length 31796, version 1.6554
Size
32 kB (31796 bytes)
Hash
00cecde981e3ef7491eba946f4b95fe0
91df089a2eb0665180da53bc86599a065d44b980
5037b298c4193baf7e920bee2999d2ab852db7a3b6b09a38c25a78db92baf69b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/fonts/00cecde981e3ef7491eba946f4b95fe0.woff HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/sbca_assetz/css/styles.42cc70d9d70c69cf625e.css
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 05:21:36 GMT
etag: "686947d-7c34-616bcba541800"
accept-ranges: bytes
content-length: 31796
vary: Accept-Encoding
content-type: font/woff
date: Wed, 24 Apr 2024 22:10:42 GMT
server: Apache
X-Firefox-Spdy: h2

securescotia.com/sbca_assetz/fonts/15243e297f5364bd59f4088a864abbf7.woff

208.109.201.129

200 OK

32 kB

URL GET HTTP/2
securescotia.com/sbca_assetz/fonts/15243e297f5364bd59f4088a864abbf7.woff
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
Web Open Font Format, TrueType, length 32264, version 1.6554
Size
32 kB (32264 bytes)
Hash
15243e297f5364bd59f4088a864abbf7
27b84bd4540518b02ed599e38dc65ed2f3c6a536
259699b7407833766a8f4e931644d014f145653439a62fc1a7167f1d3a940e25

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/fonts/15243e297f5364bd59f4088a864abbf7.woff HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/sbca_assetz/css/styles.42cc70d9d70c69cf625e.css
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 05:21:42 GMT
etag: "686947e-7e08-616bcbaafa580"
accept-ranges: bytes
content-length: 32264
vary: Accept-Encoding
content-type: font/woff
date: Wed, 24 Apr 2024 22:10:42 GMT
server: Apache
X-Firefox-Spdy: h2

securescotia.com/sbca_assetz/img/favicon.ico

208.109.201.129

200 OK

2.4 kB

URL GET HTTP/2
securescotia.com/sbca_assetz/img/favicon.ico
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
2.4 kB (2437 bytes)
Hash
234408c993ec4c0dcc1191a6115cb0fe
3d2c64c98910242d5b7b1424db3d99509cb42c5d
5eef5b46a0320022daff81cb0ea9e90329d16bd9d6123c28561997843f23598a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/img/favicon.ico HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq; _tccl_visitor=60cc5aae-b4ba-4120-8476-ea3fed235e26; _tccl_visit=60cc5aae-b4ba-4120-8476-ea3fed235e26; _scc_session=pc=1&C_TOUCH=2024-04-24T22:10:42.803Z
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 05:23:34 GMT
etag: "6869486-3c2e-616bcc15ca180-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 2437
content-type: image/x-icon
date: Wed, 24 Apr 2024 22:10:43 GMT
server: Apache
X-Firefox-Spdy: h2

104.84.152.58

200 OK

43 B

URL GET HTTP/2
events.api.secureserver.net/t/1/tl/event?dh=securescotia.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&client_name=scc-c2&cv=0.2.5&vg=60cc5aae-b4ba-4120-8476-ea3fed235e26&vtg=60cc5aae-b4ba-4120-8476-ea3fed235e26&dp=%2FscotiaLogin.php&trace_id=53a823c227e84ca1a390dfd7cbc17c2e&cts=2024-04-24T22%3A10%3A42.803Z&hit_id=bbcff24a-6a97-43aa-8c4f-3f9166b4bbf0&ht=pageview&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl492182%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229854117%22%2C%22cp_cache%22%3A%22%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=284102853&z=1234595318
IP
104.84.152.58:443
ASN
#20940 Akamai International B.V.

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.api.secureserver.net
Fingerprint86:0A:54:3C:14:92:76:57:19:E1:8B:86:AE:B6:C7:06:3C:C8:7A:58
ValidityMon, 10 Jul 2023 19:26:59 GMT - Sat, 10 Aug 2024 19:26:59 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?dh=securescotia.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&client_name=scc-c2&cv=0.2.5&vg=60cc5aae-b4ba-4120-8476-ea3fed235e26&vtg=60cc5aae-b4ba-4120-8476-ea3fed235e26&dp=%2FscotiaLogin.php&trace_id=53a823c227e84ca1a390dfd7cbc17c2e&cts=2024-04-24T22%3A10%3A42.803Z&hit_id=bbcff24a-6a97-43aa-8c4f-3f9166b4bbf0&ht=pageview&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl492182%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229854117%22%2C%22cp_cache%22%3A%22%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=284102853&z=1234595318 HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://securescotia.com
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://securescotia.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Wed, 24 Apr 2024 22:10:43 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?dh=securescotia.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&client_name=scc-c2&cv=0.2.5&vg=60cc5aae-b4ba-4120-8476-ea3fed235e26&vtg=60cc5aae-b4ba-4120-8476-ea3fed235e26&dp=%2FscotiaLogin.php&trace_id=53a823c227e84ca1a390dfd7cbc17c2e&cts=2024-04-24T22%3A10%3A42.955Z&hit_id=8907e6f7-8f3c-48da-83f6-9cebbb740df9&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl492182%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229854117%22%2C%22cp_cache%22%3A%22%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=284102853&z=1405823767&tce=1713996641672&tcs=1713996641173&tdc=1713996642950&tdclee=1713996642811&tdcles=1713996642807&tdi=1713996642805&tdl=1713996642113&tdle=1713996641173&tdls=1713996641172&tfs=1713996641171&tns=1713996641139&trqs=1713996641672&tre=1713996642024&trps=1713996642023&tles=1713996642950&tlee=0&nt=navigate&nav_type=hard

104.84.152.58

200 OK

43 B

URL GET HTTP/2
events.api.secureserver.net/t/1/tl/event?dh=securescotia.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&client_name=scc-c2&cv=0.2.5&vg=60cc5aae-b4ba-4120-8476-ea3fed235e26&vtg=60cc5aae-b4ba-4120-8476-ea3fed235e26&dp=%2FscotiaLogin.php&trace_id=53a823c227e84ca1a390dfd7cbc17c2e&cts=2024-04-24T22%3A10%3A42.955Z&hit_id=8907e6f7-8f3c-48da-83f6-9cebbb740df9&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl492182%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229854117%22%2C%22cp_cache%22%3A%22%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=284102853&z=1405823767&tce=1713996641672&tcs=1713996641173&tdc=1713996642950&tdclee=1713996642811&tdcles=1713996642807&tdi=1713996642805&tdl=1713996642113&tdle=1713996641173&tdls=1713996641172&tfs=1713996641171&tns=1713996641139&trqs=1713996641672&tre=1713996642024&trps=1713996642023&tles=1713996642950&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.58:443
ASN
#20940 Akamai International B.V.

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.api.secureserver.net
Fingerprint86:0A:54:3C:14:92:76:57:19:E1:8B:86:AE:B6:C7:06:3C:C8:7A:58
ValidityMon, 10 Jul 2023 19:26:59 GMT - Sat, 10 Aug 2024 19:26:59 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?dh=securescotia.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&client_name=scc-c2&cv=0.2.5&vg=60cc5aae-b4ba-4120-8476-ea3fed235e26&vtg=60cc5aae-b4ba-4120-8476-ea3fed235e26&dp=%2FscotiaLogin.php&trace_id=53a823c227e84ca1a390dfd7cbc17c2e&cts=2024-04-24T22%3A10%3A42.955Z&hit_id=8907e6f7-8f3c-48da-83f6-9cebbb740df9&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl492182%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229854117%22%2C%22cp_cache%22%3A%22%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=284102853&z=1405823767&tce=1713996641672&tcs=1713996641173&tdc=1713996642950&tdclee=1713996642811&tdcles=1713996642807&tdi=1713996642805&tdl=1713996642113&tdle=1713996641173&tdls=1713996641172&tfs=1713996641171&tns=1713996641139&trqs=1713996641672&tre=1713996642024&trps=1713996642023&tles=1713996642950&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://securescotia.com
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://securescotia.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Wed, 24 Apr 2024 22:10:43 GMT
X-Firefox-Spdy: h2

csp.secureserver.net/eventbus

104.110.14.92

200 OK

0 B

URL OPTIONS HTTP/1.1
csp.secureserver.net/eventbus
IP
104.110.14.92:443
ASN
#16625 AKAMAI-AS

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.secureserver.net
FingerprintB6:20:47:6F:3C:E3:DC:99:70:44:2D:CB:6A:E0:1C:12:A4:A5:A0:5C
ValidityTue, 10 Oct 2023 22:44:19 GMT - Sun, 10 Nov 2024 22:44:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

OPTIONS /eventbus HTTP/1.1
Host: csp.secureserver.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Referer: https://securescotia.com/
Origin: https://securescotia.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 0
x-amzn-requestid: 107c6eee-bee5-4da1-ad04-53e465ee21f8
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: content-type,authorization
x-amz-apigw-id: WwF3nG4gIAMENOQ=
Access-Control-Allow-Methods: OPTIONS,POST
x-amzn-trace-id: Root=1-66298363-7237a7c44eee096c2fa33565
x-envoy-upstream-service-time: 6
Expires: Wed, 24 Apr 2024 22:10:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 24 Apr 2024 22:10:43 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload

csp.secureserver.net/eventbus

104.110.14.92

200 OK

0 B

URL OPTIONS HTTP/1.1
csp.secureserver.net/eventbus
IP
104.110.14.92:443
ASN
#16625 AKAMAI-AS

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.secureserver.net
FingerprintB6:20:47:6F:3C:E3:DC:99:70:44:2D:CB:6A:E0:1C:12:A4:A5:A0:5C
ValidityTue, 10 Oct 2023 22:44:19 GMT - Sun, 10 Nov 2024 22:44:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

OPTIONS /eventbus HTTP/1.1
Host: csp.secureserver.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Referer: https://securescotia.com/
Origin: https://securescotia.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 0
x-amzn-requestid: 5b821213-53e1-4ee7-84af-27b71a36d25c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: content-type,authorization
x-amz-apigw-id: WwF3nEzzoAMEtng=
Access-Control-Allow-Methods: OPTIONS,POST
x-amzn-trace-id: Root=1-66298363-135f34f2562c3a877bbf3900
x-envoy-upstream-service-time: 5
Expires: Wed, 24 Apr 2024 22:10:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 24 Apr 2024 22:10:43 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload

csp.secureserver.net/eventbus

104.110.14.92

200 OK

0 B

URL OPTIONS HTTP/1.1
csp.secureserver.net/eventbus
IP
104.110.14.92:443
ASN
#16625 AKAMAI-AS

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.secureserver.net
FingerprintB6:20:47:6F:3C:E3:DC:99:70:44:2D:CB:6A:E0:1C:12:A4:A5:A0:5C
ValidityTue, 10 Oct 2023 22:44:19 GMT - Sun, 10 Nov 2024 22:44:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /eventbus HTTP/1.1
Host: csp.secureserver.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Authorization: api-key 8da2217409854bee82e12dc4ca0b39fb
Content-Type: application/json
Content-Length: 2017
Origin: https://securescotia.com
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 0
x-amzn-requestid: 340d8acd-73cc-422c-9904-a7ea936227f3
Access-Control-Allow-Origin: *
x-amz-apigw-id: WwF3oGC_IAMEgLQ=
x-amzn-trace-id: Root=1-66298363-4a7161d23d0bdbad5f817123
x-envoy-upstream-service-time: 102
Expires: Wed, 24 Apr 2024 22:10:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 24 Apr 2024 22:10:43 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload

csp.secureserver.net/eventbus

104.110.14.92

200 OK

0 B

URL OPTIONS HTTP/1.1
csp.secureserver.net/eventbus
IP
104.110.14.92:443
ASN
#16625 AKAMAI-AS

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerStarfield Technologies, Inc.
Subject*.secureserver.net
FingerprintB6:20:47:6F:3C:E3:DC:99:70:44:2D:CB:6A:E0:1C:12:A4:A5:A0:5C
ValidityTue, 10 Oct 2023 22:44:19 GMT - Sun, 10 Nov 2024 22:44:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /eventbus HTTP/1.1
Host: csp.secureserver.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Authorization: api-key b18ef4f046435b64a469b32c3c1c20a3
Content-Type: application/json
Content-Length: 1241
Origin: https://securescotia.com
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 202 Accepted
Content-Type: application/json
Content-Length: 0
x-amzn-requestid: 98ebf692-571b-4416-81f8-1bdd13093c0e
Access-Control-Allow-Origin: *
x-amz-apigw-id: WwF3qHL6oAMEP_Q=
x-amzn-trace-id: Root=1-66298363-189046455cd9e537464d1cf3
x-envoy-upstream-service-time: 106
Expires: Wed, 24 Apr 2024 22:10:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 24 Apr 2024 22:10:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload

securescotia.com/sbca_assetz/css/styles.42cc70d9d70c69cf625e.css

208.109.201.129

200 OK

1.4 MB

URL GET HTTP/2
securescotia.com/sbca_assetz/css/styles.42cc70d9d70c69cf625e.css
IP
208.109.201.129:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Certificate
IssuerLet's Encrypt
Subjectmail.securescotia.com
Fingerprint7F:16:AD:8D:D3:A1:18:54:81:FF:0E:9B:CA:A2:D7:0A:26:8E:92:F2
ValidityWed, 24 Apr 2024 20:34:11 GMT - Tue, 23 Jul 2024 20:34:10 GMT

File type

Size
1.4 MB (1394096 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Scotiabank

HTTP Headers

GET /sbca_assetz/css/styles.42cc70d9d70c69cf625e.css HTTP/1.1
Host: securescotia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://securescotia.com/scotiaLogin.php?sslchannel=true&sessionid=GHKc6ydOPHeRWt4ByPh5owuaCrdyDjh1Z6Re4pPiE1fbRzUJuYimDWjr4Jg7F6GV5jSGfmhtJjlARz992TTkZH465ITV3QrEm2Nyd7Skj4eOcDBFNaP32o9OdC6Oel17OA
Cookie: PHPSESSID=36no7ki3kd6luekat3h1o55vnq
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Tue, 23 Apr 2024 06:15:06 GMT
etag: "686947c-1545b0-616bd79a8ce80-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-type: text/css
date: Wed, 24 Apr 2024 22:10:42 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (16)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP