Scan report · 2 months agoPublic

traefik.ww17.jorgazsb.scotiabank-secure.info

172.239.194.103AS63949 · US

Submittedhttps://traefik.ww17.jorgazsb.scotiabank-secure.info/

Landed onhttps://amjbc.com/iuTTtmLvaYJbURWOUvBPBlJXp/148116/?md=eyJ0dmMiOjAsInMiOiIxMzY2eDc2OCIsImIiOiIxMzY2eDc2OCIsInIiOiJodHRwczovL2xpdmUuc3BvcnRzdm90LmNvbS9maWx0ZXI%2FcT0maT1YQ2FZenRGS0Rlb18wJmNpPS02Njg4OTE3MDU2MzI0MTU5ODEmdD0xNjY4MTcxODgwJmg9MyIsInEiOiJodHRwczovL2FtamJjLmNvbS9paWdJaUpWQ1FyTm1SMGYvMTQ4MTE2P3BhcmFtXzQ9bXBrZmVzMTNrNzh3d3c0NG03ZWZ3cG5ua2ZxeWhyZW5ucm5vb2RucmR3Ym9hOGU3bmJxb2FkZWt5YSIsImgiOjkwMTUsInQiOjAsInoiOjkyNjAsImsiOjAsInUiOiI2NzIzNjUzNjYwMjVlZTZlZTU0ZjUyIiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTM2Nng4NDIiLCJlIjoid2JkcTA2cDlndnVpdGZlIiwibyI6dHJ1ZSwibSI6MTc4NTY4ODE2MzY0MiwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJkbSI6OCwiaGMiOjgsImJsIjoxLCJiYyI6MiwidnYiOiJJbnRlbCBJbmMuIiwidnIiOiJJbnRlbCBJcmlzIE9wZW5HTCBFbmdpbmUiLCJhYyI6MCwiY3QiOiJ1bmtub3duIiwiY2V0IjoiNGciLCJjZGxtIjotMSwiY2RsIjoxMCwiY3J0dCI6MCwidG1zIjoxMjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJkdCI6ZmFsc2UsImNtIjp7ImZjIjo2LCJobCI6NSwibWRjIjowLCJtaSI6IjEzNTcyOTUsNDM5NTYzMDU5MiwzNjk1ODg3IiwicG1pIjoiMFdTdFZfTFR0aWxSek4yRSIsInB0Ijoibm9uZSIsInNkIjowLCJzdmMiOjAsInN0Ijoibm90X3N1cHBvcnRlZCIsInN4eSI6IjEwLDEwIn19&pdc=3nBBkf8mP_qRn2yr5_Fe0rsFEiQv1BtzHCU0LF_F6Lg&param_4=mpkfes13k78www44m7efwpnnkfqyhrennrnoodnrdwboa8e7nbqoadekya· 1 redirect

Verdict

1 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 11.4 s · 9 requests

01 · Visitor openstraefik.ww17.jorgazsb.scotiabank-secure.info

02 · Redirected · 1 hopamjbc.com/iuTTtmLvaYJbURWOUvBPBlJXp/1…nnrnoodnrdwboa8e7nbqoadekya

03 · Page shown

amjbc.com

04 · File delivered · malicious8938bfc8-0c3e-4112-a155-332e1cf1146e.html

Dangerous — confirmed threat

Automated

The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

8938bfc8-0c3e-4112-a155-332e1cf1146e.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it as a real payload — it matched known malware. Do not open or run this file.

Success

SHA-256 271fe31ea362ab8775e8400cf1ab39b632d7a64fc70c4f97d3dec71ed612c772

Infrastructure

IP: 172.239.194.103AKAMAI-LINODE-AP - Akamai Connected Cloud, SG · AS63949US
TLS: CN=YE1, O=Let's Encrypt, C=US · expires Oct 6, 2026
Redirects: 1 hop · / → /iuTTtmLvaYJbURWOUvBPBlJXp/1…nnrnoodnrdwboa8e7nbqoadekya

WHOIS

Registrar: Dynadot Inc
Created: Dec 12, 2025
Expires: Dec 12, 2026
Nameservers: ns1.oh313.parklogic.comns2.oh313.parklogic.com

11 malicious6 suspicious

Hashes & fingerprints

Page Hash70b268fa0902256c187cc1326ad68a1c363221d210b87d50940e95d5e90b1744 Favicon Hasha9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e Screenshot pHashff83838383878787 JARM27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint9BB33D71CE62FA4C0DE73FE707EADEE5FCA62785 Cert IssuerCN=YE1, O=Let's Encrypt, C=US

Page capture

Live

Visit Site

Engines

7 · time to verdict